Network-AI EUVD-2026-97633

Requires a deployment of Network-AI 5.14.0 through 5.15.1 that relies on the ClaudeHookBridge PreToolUse hook with denyPatterns configured as its guardrail. To exploit, the agent must be processing attacker-influenced input (prompt injection), and the attacker must shape a tool call so the first present candidate field (e.g. file_path or command) is benign while the dangerous payload is placed in a secondary field - specifically the Write tool's content parameter or an MCP script parameter - which the hook never evaluates. Limiting factors that reduce realistic risk: exploitation depends on a successful prompt-injection into the agent, operates only within the local agent-execution context (not remotely reachable), and matters only where denyPatterns is actually depended upon as a security control; environments not using this hook are unaffected.

The input provides only a CVSS 4.0 vector (7.5, CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) - no CVSS 3.1 vector, no EPSS score, no SSVC decision, and no KEV or POC signal are present, so several standard prioritization inputs are MISSING and cannot be weighed. The vector itself is self-limiting: AV:L means the flaw is reachable only within the local agent-execution context (not over the network), and AT:P indicates a specific attack requirement must hold - here, that the agent is processing attacker-influenced content and that a tool call can be shaped to hide the payload in a secondary field. Those preconditions, combined with CWE-436 (interpretation conflict) rather than a memory-corruption or direct-RCE class, mean the raw high technical impact (VC/VI/VA:H - code/file-write on the host) is gated behind a successful prompt-injection chain rather than a direct remote attack. Exploitation status is 'no public exploit identified at time of analysis' (no POC and no KEV in the input), so there is no evidence of active or widespread exploitation. Net: this is a genuine security-control-bypass defect worth patching for anyone running the affected product, but it is a conditional, low-real-world-risk issue for the broader population given the niche product footprint and the prompt-injection prerequisite - not an emergency on the level of a network-facing unauthenticated RCE. Note also that the input tag 'Authentication Bypass' conflicts with the CWE-436 / deny-pattern-bypass nature of the flaw and should not be read as an authentication-control failure.

An attacker seeds untrusted content (a file, web page, or tool output) that is ingested by an AI agent running Network-AI, prompt-injecting it into issuing a tool call where the benign-looking first field (e.g. file_path or command) passes the ClaudeHookBridge denyPatterns check while the actual dangerous payload rides in a secondary field such as Write content or an MCP script parameter. Because the PreToolUse hook only matches deny patterns against the first present candidate field, the malicious write or script execution is approved and runs. No public exploit identified at time of analysis, but the technique is explicitly described in the advisory.