CVE-2026-54051

Network-AI before version 5.15.1 contains a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.

In Network-AI (TypeScript/Node.js multi-agent orchestrator) before version 5.12.2, a vulnerability was found where the 'path' field in backup manifest files is trusted. An attacker can place a malicious manifest, causing arbitrary file or directory deletion during backup pruning.

Vulnerability in Network-AI (versions 5.0.0-5.12.1) in the ApprovalInbox component. The HTTP server lacks authentication and sets Access-Control-Allow-Origin: *, allowing anyone who can send an HTTP request (including websites in the operator's browser) to approve pending high-risk actions without human consent.

Vulnerability in Network-AI (versions before 5.12.2) in the file sandbox mechanism. Path checks rely on string prefix matching, allowing an agent to read files from sibling directories with similar names (e.g., /tmp/network-ai-sandbox_evil) outside the intended sandbox.

Vulnerability in Network-AI (versions before 5.12.2) in the environment backup function. The _collectBackupFiles() function follows symbolic links, allowing an attacker to place a symlink to an external directory and copy its contents into the backup archive.

Vulnerability in Network-AI (versions before 5.12.2) in the environment restore function. The restore() function does not verify that the backup path is within the allowed directory, allowing a backup ID with ../ sequences to restore files from arbitrary directories.

Network-AI before version 5.4.5 defaults to an empty MCP SSE secret, allowing any unauthenticated request to be accepted. Additionally, the CORS header permits access from any origin, enabling an attacker to remotely invoke all 22 MCP tools on a local server.

Network-AI before version 5.13.4 has an improper cryptographic signature verification vulnerability in APSAdapter. The default local verifier accepts any non-empty string as valid. An unauthenticated attacker can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain permission tokens for sensitive resources including SHELL_EXEC.

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply configured authorization to GET /approvals/ routes, allowing unauthenticated actors to access sensitive approval data including shell commands, file paths, and risk levels. Additionally, the Access-Control-Allow-Origin: * header enables cross-origin disclosure.