CVE-2026-73615

Published: Aug 13, 2026Modified: Aug 15, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.

Related CWEs

CWE-436

Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References (3)

https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-9v4f-j8cv-fhxw

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/network-ai-sandboxpolicy-before-blocklist-bypass-via-quote-mismatch

Source: disclosure@vulncheck.com

https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-9v4f-j8cv-fhxw

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.