Is CVE-2026-64622 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64622 being exploited in the wild.

How severe is CVE-2026-64622?

High severity, with a CVSS score of 7.5, published 20 July 2026.

Which products and versions are affected?

Jovancoding Network-AI 5.12.2 through 5.13.3.

Is there a fix for CVE-2026-64622?

A patch was published on 2026-07-20: Version 5.13.4 released to address the incomplete fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64622 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-64622?

Check whether you run Jovancoding Network-AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64622: Jovancoding Network-AI missing authorization in ApprovalInbox GET routes

CVE-2026-64622 · Severity: high · CVSS 7.5 · Published 2026-07-20

Network-AI, a tool used for managing automated network actions, contains a security flaw where sensitive approval requests are exposed to unauthorized users. Even if a password is set, an attacker can view pending system commands, file paths, and justifications for high-risk actions. Additionally, a configuration error allows malicious websites to steal this information if an administrator visits them while logged into the tool.

Technologies: Jovancoding Network-AI. Vendors: Jovancoding.

Quick answers

Is CVE-2026-64622 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64622 being exploited in the wild.
How severe is CVE-2026-64622?: High severity, with a CVSS score of 7.5, published 20 July 2026.
Which products and versions are affected?: Jovancoding Network-AI 5.12.2 through 5.13.3.
Is there a fix for CVE-2026-64622?: A patch was published on 2026-07-20: Version 5.13.4 released to address the incomplete fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64622 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-64622?: Check whether you run Jovancoding Network-AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the ApprovalInbox component of the network-ai npm package. While a previous fix (GHSA-mxjx-28vx-xjjj) implemented authorization for mutating POST requests, it failed to apply the 'checkAuth' logic to GET routes including /approvals/?status=all, /approvals/:id, /approvals/stats, and /approvals/sse. An unauthenticated attacker can access these endpoints to retrieve full ApprovalEntry details, such as shell-command strings and file paths. Furthermore, the application uses a hardcoded 'Access-Control-Allow-Origin: *' header, facilitating cross-origin data exfiltration via a victim's browser. The issue is patched in version 5.13.4.

Affected products

Jovancoding Network-AI (npm: network-ai) 5.12.2 through 5.13.3

Timeline

2026-07-05: advisory: Vendor advisory GHSA-m4jg-6w3q-gm86 published
2026-07-20: disclosed: CVE-2026-64622 published to NVD
2026-07-20: patched: Version 5.13.4 released to address the incomplete fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.