Skip to content
Threat Feed
Subscribe

Vendor

Network-AI

4 briefs RSS
high advisory

Security Control Bypass in Network-AI ClaudeHookBridge

Network-AI versions 5.14.0 through 5.15.1 contain a security control bypass in the ClaudeHookBridge PreToolUse hook, enabling prompt-injected agents to execute arbitrary scripts or deploy web shells.

Network-AI
2t 1c
high advisory

Security Matcher Bypass in Network-AI

Network-AI versions prior to 5.15.1 are vulnerable to a command injection bypass where inconsistent quote handling between SandboxPolicy and the executor allows attackers to evade blocklist checks.

Network-AI
1t 1c
high advisory

Security Bypass in Network-AI ClaudeHookBridge via Input Truncation

CVE-2026-73614 in ClaudeHookBridge allows attackers to bypass security deny-lists by appending malicious command strings beyond a 500-character truncation threshold, resulting in potential arbitrary code execution.

ClaudeHookBridge vulnerability command-injection code-execution
1t 1c
high advisory

Authorization Bypass in Network-AI npm Package CVE-2026-64622

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 are vulnerable to an authorization bypass (CVE-2026-64622) that allows unauthenticated actors to access sensitive approval request details via specific GET read routes like /approvals/. This vulnerability discloses critical information such as shell-command strings, file paths, justifications, and risk levels. Additionally, a hardcoded 'Access-Control-Allow-Origin: *' header in responses facilitates cross-origin data disclosure, enabling potential exfiltration from malicious websites an operator might visit.

Network-AI vulnerability authorization-bypass information-disclosure npm
1r 2t 1c