EUVD-2026-45937
GHSA-xvgx-9rph-3pj6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network GET routes ignore the configured secret (AV:N/AC:L/PR:N/UI:N); impact is disclosure of sensitive approval data only, so C:H with I and A none.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.
Articles & Coverage 1
AnalysisAI
Unauthenticated information disclosure in the Network-AI (npm: network-ai) package versions 5.12.2 through 5.13.3 lets remote actors read the ApprovalInbox even when an operator has configured a checkAuth/secret, because the authorization check was never wired into the GET read routes. Exploitation exposes full approval-request content - including pending shell-command strings, file paths, justifications, and risk levels - and a hardcoded Access-Control-Allow-Origin:* header allows any website an operator visits to exfiltrate the same data cross-origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Network-AI ApprovalInbox HTTP routes must be network-reachable by the attacker (or reachable from an operator's browser for the CORS variant), and an affected version 5.12.2-5.13.3 must be running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, base 9.3) correctly reflects a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which matches the description of routes that ignore the configured secret. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Network-AI service issues a plain GET to /approvals/?status=all or /approvals/sse with no secret and receives the full queue of pending approval entries, harvesting the exact shell commands, target file paths, and justifications an AI agent is waiting to run. Alternatively, the attacker lures an operator to a malicious web page that uses the wildcard CORS header to fetch those same routes from the operator's browser and exfiltrate the results. … |
| Remediation | Upgrade the network-ai npm package to a release later than 5.13.3 that applies the checkAuth/secret guard to all ApprovalInbox GET routes; the input data does not include an exact fixed version, so consult the GHSA-m4jg-6w3q-gm86 advisory (https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86) and the VulnCheck advisory (https://www.vulncheck.com/advisories/network-ai-through-missing-authorization-via-approvalinbox) for the patched version before deploying, and do not assume the prior GHSA-mxjx-28vx-xjjj fix is sufficient because this CVE is explicitly an incomplete fix for it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an inventory of all systems using the Network-AI npm package versions 5.12.2-5.13.3 and restrict network access to affected instances to trusted administrative networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today