CVE-2026-109330: falha de média gravidade em Jovancoding Network-AI
Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Jovancoding · Network-AICVEs relacionadas — Jovancoding Network-AI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73614HIGHNetwork-AI ClaudeHookBridge Deny Pattern Bypass via TruncationEPSS 0.7%CVE-2026-73615HIGHNetwork-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote MismatchEPSS 0.7%CVE-2026-42856HIGHNetwork-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool callsEPSS 0.5%CVE-2026-120313HIGHNetwork-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePathEPSS 0.5%CVE-2026-64622CRITICALNetwork-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInboxEPSS 0.5%CVE-2026-54051CRITICALNetwork-AI has an an OS Command Injection issueEPSS 0.5%