Veille CVE

Recherche « Jovancoding Network-AI »

5 CVE

Critique 0 Élevée 3 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Jovancoding Network-AI » ✕
  1. CVE-2026-109332 3.1 Faible

    Jovancoding Network-AI

    Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin.

  2. CVE-2026-109331 7.4 Élevée

    Jovancoding Network-AI

    Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.

  3. CVE-2026-109330 4.3 Moyenne

    Jovancoding Network-AI

    Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.

  4. CVE-2026-73615 8.8 Élevée

    Jovancoding Network-AI

    Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.

  5. CVE-2026-73614 8.8 Élevée

    Jovancoding Network-AI

    Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.