CVE-2026-109331

Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin.

Vulnerability in Network-AI (TypeScript/Node.js) before version 5.9.1 allows bypassing the shell command allowlist. An attacker can execute arbitrary commands by injecting special characters (e.g., `;`).

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.

Network-AI before version 5.15.1 contains a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.

In Network-AI (TypeScript/Node.js multi-agent orchestrator) before version 5.12.2, a vulnerability was found where the 'path' field in backup manifest files is trusted. An attacker can place a malicious manifest, causing arbitrary file or directory deletion during backup pruning.

Vulnerability in Network-AI (versions 5.0.0-5.12.1) in the ApprovalInbox component. The HTTP server lacks authentication and sets Access-Control-Allow-Origin: *, allowing anyone who can send an HTTP request (including websites in the operator's browser) to approve pending high-risk actions without human consent.

Vulnerability in Network-AI (versions before 5.12.2) in the file sandbox mechanism. Path checks rely on string prefix matching, allowing an agent to read files from sibling directories with similar names (e.g., /tmp/network-ai-sandbox_evil) outside the intended sandbox.

Vulnerability in Network-AI (versions before 5.12.2) in the environment backup function. The _collectBackupFiles() function follows symbolic links, allowing an attacker to place a symlink to an external directory and copy its contents into the backup archive.

Vulnerability in Network-AI (versions before 5.12.2) in the environment restore function. The restore() function does not verify that the backup path is within the allowed directory, allowing a backup ID with ../ sequences to restore files from arbitrary directories.