CVE-2026-73615
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Network-AI before version 5.15.1 contains a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.
Risk Assessment
Risk of bypassing security controls and executing unauthorized commands in Network-AI environment, potentially leading to system integrity compromise and unauthorized access.
Recommendation
Immediately upgrade Network-AI to version 5.15.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.