Executive brief
Network-AI is a tool used to manage and coordinate multiple AI agents. A security flaw in its sandbox allows these agents to bypass command restrictions and run unauthorized programs on the host server. If an agent is compromised or malicious, it could take full control of the underlying system, potentially leading to data theft or service disruption.
Technical details
Network-AI prior to version 5.9.1 is vulnerable to OS command injection (CWE-78) within its agent sandbox. The `SandboxPolicy.isCommandAllowed` function uses glob-matching to validate commands against an allowlist, but the `ShellExecutor` subsequently executes these strings using `/bin/sh -c` (or `cmd.exe /c`). Because the allowlist matching does not account for shell metacharacters, an attacker can append malicious commands (e.g., using `;`, `&`, or `|`) to a string that otherwise matches a wildcard pattern like `git *`. This results in arbitrary code execution with the privileges of the orchestrator process. The vulnerability is fixed in v5.9.1 by switching to `spawn` with `shell: false` and implementing a quote-aware tokenizer that rejects unquoted shell metacharacters.
Affected products
- Jovancoding Network-AI < 5.9.1
Timeline
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE-2026-54051 published to NVD
- 2026-07-20: patched: Fixed in version 5.9.1