Executive brief
Network-AI is a JavaScript library for securely executing commands in sandboxed environments. A flaw in its security policy engine allows attackers with access to command execution (e.g., compromised agents) to craft specially-quoted commands that bypass blocklist restrictions and human approval gates, enabling execution of dangerous operations like recursive file deletion or unapproved git/npm commands that should have been blocked.
Technical details
The vulnerability stems from a validator-executor mismatch in Network-AI's SandboxPolicy (CWE-436). The security matchers (isCommandAllowed, requiresApproval, assessRisk) evaluate raw command strings with quote characters preserved, while the downstream executor (tokenizeCommand → parseCommandLine) canonicalizes commands by stripping quotes and collapsing whitespace before spawn(). An attacker can insert quotes around command components (e.g., rm -rf '/' or git "push") to evade glob-based blocklist/allowlist matching, since literal quote characters break the regex anchors, yet the executor silently removes quotes and executes the dangerous argv. This affects agents with wildcard allowlists (e.g., rm *, git *) and can bypass both the blockedCommands safety net and approval gates. Exploitation requires agent-level access but does not require shell mode or metacharacter injection. Patch available in version 5.15.1.
Affected products
- Jovan Coding Network-AI < 5.15.1
Timeline
- 2026-07-28: disclosed
- 2026-08-13: advisory
- 2026-08-13: patched: Version 5.15.1 released with fix