Security Bypass in Network-AI ClaudeHookBridge via Input Truncation

CVE-2026-73614 affects Network-AI ClaudeHookBridge versions prior to 5.15.1. The vulnerability arises from an input validation discrepancy between the security evaluation logic and the final command execution engine. Specifically, the component truncates command strings to 500 characters when checking against configured denyPatterns. However, the downstream Claude Code execution engine processes the full, untruncated command string.

This discrepancy allows an attacker to bypass intended security constraints by padding the start of a command with benign or whitespace characters until the malicious payload is positioned beyond the 500-character truncation limit. Once the payload crosses this threshold, the security filter fails to evaluate the malicious content, enabling the execution of arbitrary commands. This issue is critical for environments relying on ClaudeHookBridge to restrict command execution based on specific patterns or keywords, as it provides a bypass mechanism for existing security policies.

Impact

Successful exploitation allows for the execution of arbitrary shell commands, potentially leading to unauthorized system access, data exfiltration, or complete system compromise in environments where the component is used to manage or execute automated code workflows. Organizations relying on ClaudeHookBridge for command-line interface security policy enforcement are at high risk.

Recommendation

• Update ClaudeHookBridge to version 5.15.1 or higher immediately to address the input truncation discrepancy.
• Audit logs for command execution patterns originating from automated code tools that utilize excessive whitespace or padding characters in command arguments.
• Implement stricter command execution policies at the operating system or environment level that do not rely solely on string-matching filters within application-level hooks.