# CVE-2026-73615: Network-AI SandboxPolicy security matcher bypass via quote mismatch

Source: https://junglewise.ai/threats/cve-2026-73615-network-ai-sandboxpolicy-security-matcher-bypass-via-quote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73615 · Severity: high · CVSS 8.8 · Published 2026-08-13

Network-AI is a JavaScript library for securely executing commands in sandboxed environments. A flaw in its security policy engine allows attackers with access to command execution (e.g., compromised agents) to craft specially-quoted commands that bypass blocklist restrictions and human approval gates, enabling execution of dangerous operations like recursive file deletion or unapproved git/npm commands that should have been blocked.

## Quick answers

**Is CVE-2026-73615 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73615 being exploited in the wild.

**How severe is CVE-2026-73615?** High severity, with a CVSS score of 8.8, published 13 August 2026.

**Which products and versions are affected?** Jovan Coding Network-AI < 5.15.1.

**Is there a fix for CVE-2026-73615?** A patch was published on 2026-08-13: Version 5.15.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73615 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73615?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from a validator-executor mismatch in Network-AI's SandboxPolicy (CWE-436). The security matchers (isCommandAllowed, requiresApproval, assessRisk) evaluate raw command strings with quote characters preserved, while the downstream executor (tokenizeCommand → parseCommandLine) canonicalizes commands by stripping quotes and collapsing whitespace before spawn(). An attacker can insert quotes around command components (e.g., rm -rf '/' or git "push") to evade glob-based blocklist/allowlist matching, since literal quote characters break the regex anchors, yet the executor silently removes quotes and executes the dangerous argv. This affects agents with wildcard allowlists (e.g., rm *, git *) and can bypass both the blockedCommands safety net and approval gates. Exploitation requires agent-level access but does not require shell mode or metacharacter injection. Patch available in version 5.15.1.

## Affected products

- Jovan Coding Network-AI < 5.15.1

## Timeline

- 2026-07-28: disclosed
- 2026-08-13: advisory
- 2026-08-13: patched: Version 5.15.1 released with fix

## References

- [https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-9v4f-j8cv-fhxw](https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-9v4f-j8cv-fhxw)
- [https://www.vulncheck.com/advisories/network-ai-sandboxpolicy-before-blocklist-bypass-via-quote-mismatch](https://www.vulncheck.com/advisories/network-ai-sandboxpolicy-before-blocklist-bypass-via-quote-mismatch)