EUVD-2026-57819
GHSA-x5mx-wq8q-46ph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low-privilege authentication required; scope unchanged (no lateral system impact per CVSS 4.0 SC:N); high C/I/A reflects arbitrary command execution on the vulnerable host.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.
AnalysisAI
SandboxPolicy bypass in Network-AI (versions before 5.15.1) enables authenticated attackers to execute arbitrary blocked commands by exploiting a parsing discrepancy between the policy engine and the command executor. The SandboxPolicy evaluates raw command strings with quotes intact, passing them through blocklist and approval-gate checks, while the executor subsequently strips those quotes during tokenization and runs the actual dangerous argv. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with at least low-privilege access to the Network-AI command submission interface, as confirmed by the PR:L metric in the provided CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (High) is driven by a network-accessible attack vector (AV:N), low complexity (AC:L), no special attack timing requirements (AT:N), low-privilege authentication (PR:L), and high impact across confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Network-AI to version 5.15.1 or later, which resolves the quote-handling discrepancy between SandboxPolicy and the command executor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Network-AI instances and confirm which versions precede 5.15.1; immediately restrict network access to administrative accounts and revoke or disable network connectivity for non-essential users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Network Ai
View allAuthentication bypass in Network-AI versions 5.7.1 and earlier allows unauthenticated remote attackers to invoke all 22
Truncation-induced interpretation conflict in Network-AI ClaudeHookBridge before 5.15.1 enables low-privileged attackers
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who ca
Sandbox path containment bypass in Network-AI's AgentRuntime (npm package `network-ai` by jovancoding) allows any low-pr
Path traversal in Network-AI's EnvironmentManager.restore() allows a local authenticated caller to copy arbitrary direct
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the i
Symlink traversal in Network-AI's EnvironmentManager.backup() allows a local attacker with write access to an environmen
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today