{"data":{"id":"90aa4047-dc2c-49e4-8de1-d86718751eb4","title":"GHSA-qw6v-5fcf-5666: Network-AI: Improper Neutralization of Special Elements used in an OS Command ","summary":"Network-AI's agent sandbox checks shell commands against an allowlist by glob-matching the whole command string, but ShellExecutor passes that string to /bin/sh -c. A wildcard allow such as git * therefore also matches git status; id, so any agent with a single wildcard allow can run arbitrary commands as the orchestrator process. A proof of concept against network-ai@5.8.5 confirmed the injected id command ran.","solution":"Fixed in v5.9.1 (commit 379f776): ShellExecutor now runs commands via spawn(file, args, { shell: false }) using a quote-aware parsed argv, and SandboxPolicy.isCommandAllowed and the new SandboxPolicy.tokenizeCommand reject unquoted shell metacharacters and unterminated quotes before the allowlist glob match.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-qw6v-5fcf-5666","publishedAt":"2026-06-19T13:35:05.000Z","cveId":"CVE-2026-54051","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["network-ai@< 5.9.1 (fixed: 5.9.1)"],"affectedPackageNames":["network-ai"],"affectedPackageRefs":["npm:network-ai"],"affectedVendors":[],"affectedVendorsRaw":["Network-AI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00468,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-qw6v-5fcf-5666"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-19T13:35:05.000Z","fixReleasedAt":"2026-06-02T20:43:35.885Z","daysToFix":-17,"fixCheckedAt":"2026-10-29T21:34:16.393Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"network-ai","fixedVersion":"5.9.1","matchedVersion":"5.9.1","fixReleasedAt":"2026-06-02T20:43:35.885Z","daysToFix":-17,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:16.246Z"}]}}