CVE-2026-73614
HighCVSS 8.8Summary
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.
Risk Assessment
Risk of bypassing blocklists and executing arbitrary commands in Claude Code environment, potentially leading to unauthorized actions and security breaches.
Recommendation
Upgrade Network-AI to version 5.15.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.