CVE-2026-109331: fallo de gravedad alta en Jovancoding Network-AI
Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.1%
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Jovancoding · Network-AICVEs relacionadas — Jovancoding Network-AI
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-73614HIGHNetwork-AI ClaudeHookBridge Deny Pattern Bypass via TruncationEPSS 0.7%CVE-2026-73615HIGHNetwork-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote MismatchEPSS 0.7%CVE-2026-42856HIGHNetwork-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool callsEPSS 0.5%CVE-2026-120313HIGHNetwork-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePathEPSS 0.5%CVE-2026-64622CRITICALNetwork-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInboxEPSS 0.5%CVE-2026-54051CRITICALNetwork-AI has an an OS Command Injection issueEPSS 0.5%