EUVD-2026-46020Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Wildcard CORS CSRF path requires operator browser visit (UI:R, AC:H); non-loopback binding enables direct PR:N/UI:N exploitation scored separately at 8.1.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox (lib/approval-inbox.ts). It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets Access-Control-Allow-Origin: * on every route, including the state-changing POST /approvals/:id/approve and /deny. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port - a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) - can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. ApprovalInbox now accepts a secret option. When set, the mutating endpoints POST /:id/approve and POST /:id/deny require an Authorization: Bearer <secret> header, validated in constant time with crypto.timingSafeEqual. startServer() already binds to 127.0.0.1 by default; operators exposing the inbox on a network must set a secret.
AnalysisAI
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CSRF path (the lower 5.9 CVSS score) requires: (1) the target application uses ApprovalGate/ApprovalInbox - this is not enabled by default in all network-ai deployments, only when operators explicitly configure human-in-the-loop gates; (2) at least one approval is pending in the queue at the time of attack, providing a valid approval ID; (3) the operator visits a malicious webpage while the inbox server is running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 score of 5.9 Medium (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N) models the CSRF path against the default 127.0.0.1 binding - the high complexity (AC:H) and required user interaction (UI:R) reflect the social engineering step of luring the operator to a malicious page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a webpage containing JavaScript that issues a fetch() or XMLHttpRequest POST to http://127.0.0.1:<inbox_port>/approvals/<known-or-guessed-id>/approve; because ApprovalInbox sets Access-Control-Allow-Origin: * with no preflight restriction, the operator's browser sends the request when they visit the page, silently approving a pending shell command or write operation the AI agent had queued for review. No public proof-of-concept code has been identified, but the attack is constructable with fewer than ten lines of standard browser JavaScript given knowledge of the inbox port and any pending approval ID. |
| Remediation | Upgrade to network-ai v5.12.2, confirmed by the vendor release at https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2 and patch commit https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today