Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, "EnvironmentManager.listBackups()" reads each backup's "_manifest.json" and trusts the manifest's "path" field. "EnvironmentManager.pruneBackups()" later passes that trusted "entry.path" directly to "rmSync(entry.path, { recursive: true, force: true })". An attacker who can place or modify a manifest inside "data/<env>/.backups/<name>/_manifest.json" can cause "network-ai env backup prune --env <env> --keep <n>" or any code path invoking "pruneBackups()" to recursively delete an arbitrary path accessible to the Network-AI process user. This is fixed in v5.12.2. "pruneBackups()" no longer passes "entry.path" from the on-disk manifest to "rmSync". The deletion path is recomputed from a format-validated "entry.backupId", and a "dirname" containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. ""path": "/"") is now inert.