Network-AI Pre-5.15.1 SandboxPolicy Command Bypass

Executive Summary

CVE-2026-73615 is a security flaw in Network-AI versions before 5.15.1 where SandboxPolicy evaluates raw command strings with quotes preserved but the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that bypass blocklist checks and approval gates while the executor runs the identical unquoted dangerous command.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the Network-AI version and inspecting command execution logs for inconsistencies between raw and tokenized commands. Use npm list network-ai to verify the installed version. If using version 5.15.0 or below, the system is vulnerable. Monitor command execution logs for quoted commands that bypass security checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass security controls like blocklists and approval gates, potentially executing unauthorized commands. This could lead to data deletion, unauthorized code execution, or privilege escalation, depending on the commands allowed by the system.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Network-AI to version 5.15.1 or later using npm update network-ai. If updating is not possible, implement additional sandboxing or command validation layers that normalize quotes and whitespace before security checks. Review and tighten blocklists to account for quote-based bypasses.

Useful 0 Not Useful 0