CVE-2026-73614: fallo de gravedad alta en Jovancoding Network-AI
Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.7%
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Jovancoding · Network-AICVEs relacionadas — Jovancoding Network-AI
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-73615HIGHNetwork-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote MismatchEPSS 0.7%CVE-2026-42856HIGHNetwork-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool callsEPSS 0.5%CVE-2026-120313HIGHNetwork-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePathEPSS 0.5%CVE-2026-64622CRITICALNetwork-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInboxEPSS 0.5%CVE-2026-54051CRITICALNetwork-AI has an an OS Command Injection issueEPSS 0.5%CVE-2026-120312HIGHNetwork-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette NameEPSS 0.4%