CVE-2026-73615
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.
436
Interpretation Conflict
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Other
Potential Impacts:
Unexpected State
Varies By Context
Applicable Platforms
All platforms may be affected
https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-9v4f-j8cv-fh…
https://www.vulncheck.com/advisories/network-ai-sandboxpolicy-before-blocklist-…