Jovancoding
Monthly
Deny-pattern bypass in Network-AI's ClaudeHookBridge PreToolUse hook (versions 5.14.0 through 5.15.1) allows a prompt-injected agent to smuggle dangerous payloads past configured denyPatterns by placing a benign value in the first candidate field the hook inspects (such as file_path or command) while putting the actual malicious content in a secondary field the hook never evaluates, notably the Write tool's content parameter or an MCP script parameter - enabling web shell writes or script execution inside the local agent-execution context. The affected deployment must rely on the PreToolUse hook with denyPatterns as its guardrail, and exploitation additionally requires a successful prompt injection into the agent, which is why risk is bounded to local agent workflows rather than remote reachability; CVSS 4.0 scores 7.5 with attack requirements present (AT:P), and the assessed CVSS 3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no prior authentication or user interaction is required per the vector but the attack is local and complex. There is confirmed actively exploited status not present - no CISA KEV listing and no public exploit code - so at time of analysis no public exploit identified at time of analysis; EPSS, SSVC, and KEV signals were absent from the supplied intelligence, so prioritization inputs remain incomplete.
SandboxPolicy bypass in Network-AI (versions before 5.15.1) enables authenticated attackers to execute arbitrary blocked commands by exploiting a parsing discrepancy between the policy engine and the command executor. The SandboxPolicy evaluates raw command strings with quotes intact, passing them through blocklist and approval-gate checks, while the executor subsequently strips those quotes during tokenization and runs the actual dangerous argv. No public exploit has been identified at time of analysis, but the bypass mechanism is mechanistically straightforward, requiring only knowledge of the quote-handling discrepancy to exploit via the network with low-privilege credentials.
Truncation-induced interpretation conflict in Network-AI ClaudeHookBridge before 5.15.1 enables low-privileged attackers to bypass operator-configured denyPatterns and achieve arbitrary command execution. The bridge evaluates security patterns against only the first 500 characters of a submitted Bash command field while Claude Code receives and executes the full, untruncated string - meaning any payload positioned past byte 500 is invisible to the deny list but fully executable by the runtime. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 base score of 8.7 and low attack complexity signal that operationalizing this bypass requires minimal skill once low-privilege bridge access is obtained.
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who can write into an environment's backup directory to delete any path the process user can access. `EnvironmentManager.pruneBackups()` trusts the `path` field of an attacker-controllable `_manifest.json` and feeds it straight into `rmSync(..., { recursive: true, force: true })`, so a poisoned manifest such as `"path": "/"` gets deleted when `network-ai env backup prune` runs. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); there is no public exploit identified as actively exploited and it is not in CISA KEV.
Authentication bypass in Network-AI versions 5.7.1 and earlier allows unauthenticated remote attackers to invoke all 22 MCP tools on the SSE server because the default secret is empty and `_isAuthorized()` returns true when no secret is configured. Despite the partial fix for CVE-2026-46701 in 5.4.5 (which restricted CORS to localhost origins), any non-browser caller - curl, SSRF, or a service exposed via a 0.0.0.0 bind - can still call privileged operations like `config_set`, `agent_spawn`, `blackboard_write`, and token management with zero credentials. No public exploit identified at time of analysis, but the GHSA advisory includes annotated source-code locations that effectively serve as a roadmap for exploitation.
Cross-origin information disclosure in Network-AI (npm package network-ai) before 5.15.2 stems from an origin validation error in McpSseServer._handleRequest (lib/mcp-transport-sse.ts) that reflects a localhost Origin into the Access-Control-Allow-Origin response header regardless of which interface the server binds. An attacker-controlled page carrying a localhost Origin can therefore read unauthenticated endpoints such as /health cross-origin, but only when the operator has bound the MCP SSE server to a non-loopback address (a non-default configuration) and a victim visits that malicious page - no public exploit code identified at time of analysis. Impact is limited to low-sensitivity information disclosure (assessed CVSS:3.1 base 3.0, C:L/I:N/A:N), and the reported CVSS 4.0 base of 2.3 is consistent with this low-priority characterization.
Cross-site WebSocket hijacking in Network-AI (vendor: jovancoding) versions 5.0.0 up to but not including 5.15.2 lets an attacker-controlled web page open a WebSocket to the victim's loopback DashboardServer and read live agent topology - agent IDs, roles, task descriptions and token budgets. The upgrade handler performs no Origin or token check, so the connection is unauthenticated (CVSS PR:N), but exploitation still requires the victim to be actively running the dashboard and to be lured into loading a malicious page in a browser on the same host (UI:P), which keeps the CVSS 4.0 base score at 5.3 and our re-scored CVSS 3.1 at AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. Impact is confined to read-only reconnaissance - no write, disruption or code-execution component - and no public exploit code was identified at time of analysis.
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.
Sandbox path containment bypass in Network-AI's AgentRuntime (npm package `network-ai` by jovancoding) allows any low-privileged agent or user with access to `AgentRuntime.readFile()` or `AgentRuntime.listDir()` to read or enumerate files outside the configured `basePath` sandbox by targeting sibling directories whose names share the sandbox's string prefix. Versions 5.12.1 and earlier are confirmed vulnerable (CPE: cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*, EUVD-2026-46018). A working proof-of-concept is included in the GitHub security advisory GHSA-jvcm-f35g-w78p; no public exploit confirmed in active exploitation and the vulnerability is not listed in the CISA KEV catalog.
Symlink traversal in Network-AI's EnvironmentManager.backup() allows a local attacker with write access to an environment data directory to exfiltrate arbitrary files from outside the environment root into readable backup artifacts. All Network-AI versions prior to 5.12.2 (npm package jovancoding/network-ai) are affected, confirmed in v5.12.1 per GHSA-6x2m-p4xp-wg22. A proof-of-concept is publicly available in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.
Path traversal in Network-AI's EnvironmentManager.restore() allows a local authenticated caller to copy arbitrary directories from outside the designated backups directory into any environment data directory. All versions prior to 5.12.2 (confirmed in 5.12.1) are affected, as the backupId parameter is concatenated with path.join() without containment checks, and the restore path is reachable by default through the bundled CLI. A working proof-of-concept is publicly documented in the GHSA advisory; no CISA KEV listing was identified at time of analysis.
Deny-pattern bypass in Network-AI's ClaudeHookBridge PreToolUse hook (versions 5.14.0 through 5.15.1) allows a prompt-injected agent to smuggle dangerous payloads past configured denyPatterns by placing a benign value in the first candidate field the hook inspects (such as file_path or command) while putting the actual malicious content in a secondary field the hook never evaluates, notably the Write tool's content parameter or an MCP script parameter - enabling web shell writes or script execution inside the local agent-execution context. The affected deployment must rely on the PreToolUse hook with denyPatterns as its guardrail, and exploitation additionally requires a successful prompt injection into the agent, which is why risk is bounded to local agent workflows rather than remote reachability; CVSS 4.0 scores 7.5 with attack requirements present (AT:P), and the assessed CVSS 3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no prior authentication or user interaction is required per the vector but the attack is local and complex. There is confirmed actively exploited status not present - no CISA KEV listing and no public exploit code - so at time of analysis no public exploit identified at time of analysis; EPSS, SSVC, and KEV signals were absent from the supplied intelligence, so prioritization inputs remain incomplete.
SandboxPolicy bypass in Network-AI (versions before 5.15.1) enables authenticated attackers to execute arbitrary blocked commands by exploiting a parsing discrepancy between the policy engine and the command executor. The SandboxPolicy evaluates raw command strings with quotes intact, passing them through blocklist and approval-gate checks, while the executor subsequently strips those quotes during tokenization and runs the actual dangerous argv. No public exploit has been identified at time of analysis, but the bypass mechanism is mechanistically straightforward, requiring only knowledge of the quote-handling discrepancy to exploit via the network with low-privilege credentials.
Truncation-induced interpretation conflict in Network-AI ClaudeHookBridge before 5.15.1 enables low-privileged attackers to bypass operator-configured denyPatterns and achieve arbitrary command execution. The bridge evaluates security patterns against only the first 500 characters of a submitted Bash command field while Claude Code receives and executes the full, untruncated string - meaning any payload positioned past byte 500 is invisible to the deny list but fully executable by the runtime. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 base score of 8.7 and low attack complexity signal that operationalizing this bypass requires minimal skill once low-privilege bridge access is obtained.
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who can write into an environment's backup directory to delete any path the process user can access. `EnvironmentManager.pruneBackups()` trusts the `path` field of an attacker-controllable `_manifest.json` and feeds it straight into `rmSync(..., { recursive: true, force: true })`, so a poisoned manifest such as `"path": "/"` gets deleted when `network-ai env backup prune` runs. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); there is no public exploit identified as actively exploited and it is not in CISA KEV.
Authentication bypass in Network-AI versions 5.7.1 and earlier allows unauthenticated remote attackers to invoke all 22 MCP tools on the SSE server because the default secret is empty and `_isAuthorized()` returns true when no secret is configured. Despite the partial fix for CVE-2026-46701 in 5.4.5 (which restricted CORS to localhost origins), any non-browser caller - curl, SSRF, or a service exposed via a 0.0.0.0 bind - can still call privileged operations like `config_set`, `agent_spawn`, `blackboard_write`, and token management with zero credentials. No public exploit identified at time of analysis, but the GHSA advisory includes annotated source-code locations that effectively serve as a roadmap for exploitation.
Cross-origin information disclosure in Network-AI (npm package network-ai) before 5.15.2 stems from an origin validation error in McpSseServer._handleRequest (lib/mcp-transport-sse.ts) that reflects a localhost Origin into the Access-Control-Allow-Origin response header regardless of which interface the server binds. An attacker-controlled page carrying a localhost Origin can therefore read unauthenticated endpoints such as /health cross-origin, but only when the operator has bound the MCP SSE server to a non-loopback address (a non-default configuration) and a victim visits that malicious page - no public exploit code identified at time of analysis. Impact is limited to low-sensitivity information disclosure (assessed CVSS:3.1 base 3.0, C:L/I:N/A:N), and the reported CVSS 4.0 base of 2.3 is consistent with this low-priority characterization.
Cross-site WebSocket hijacking in Network-AI (vendor: jovancoding) versions 5.0.0 up to but not including 5.15.2 lets an attacker-controlled web page open a WebSocket to the victim's loopback DashboardServer and read live agent topology - agent IDs, roles, task descriptions and token budgets. The upgrade handler performs no Origin or token check, so the connection is unauthenticated (CVSS PR:N), but exploitation still requires the victim to be actively running the dashboard and to be lured into loading a malicious page in a browser on the same host (UI:P), which keeps the CVSS 4.0 base score at 5.3 and our re-scored CVSS 3.1 at AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. Impact is confined to read-only reconnaissance - no write, disruption or code-execution component - and no public exploit code was identified at time of analysis.
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.
Sandbox path containment bypass in Network-AI's AgentRuntime (npm package `network-ai` by jovancoding) allows any low-privileged agent or user with access to `AgentRuntime.readFile()` or `AgentRuntime.listDir()` to read or enumerate files outside the configured `basePath` sandbox by targeting sibling directories whose names share the sandbox's string prefix. Versions 5.12.1 and earlier are confirmed vulnerable (CPE: cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*, EUVD-2026-46018). A working proof-of-concept is included in the GitHub security advisory GHSA-jvcm-f35g-w78p; no public exploit confirmed in active exploitation and the vulnerability is not listed in the CISA KEV catalog.
Symlink traversal in Network-AI's EnvironmentManager.backup() allows a local attacker with write access to an environment data directory to exfiltrate arbitrary files from outside the environment root into readable backup artifacts. All Network-AI versions prior to 5.12.2 (npm package jovancoding/network-ai) are affected, confirmed in v5.12.1 per GHSA-6x2m-p4xp-wg22. A proof-of-concept is publicly available in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.
Path traversal in Network-AI's EnvironmentManager.restore() allows a local authenticated caller to copy arbitrary directories from outside the designated backups directory into any environment data directory. All versions prior to 5.12.2 (confirmed in 5.12.1) are affected, as the backupId parameter is concatenated with path.join() without containment checks, and the restore path is reachable by default through the bundled CLI. A working proof-of-concept is publicly documented in the GHSA advisory; no CISA KEV listing was identified at time of analysis.