GHSA-qw6v-5fcf-5666: Network-AI: Improper Neutralization of Special Elements used in an OS Command

Summary

Network-AI's agent sandbox checks shell commands against an allowlist by glob-matching the whole command string, but ShellExecutor passes that string to /bin/sh -c. A wildcard allow such as git * therefore also matches git status; id, so any agent with a single wildcard allow can run arbitrary commands as the orchestrator process. A proof of concept against network-ai@5.8.5 confirmed the injected id command ran.

Mitigation

Fixed in v5.9.1 (commit 379f776): ShellExecutor now runs commands via spawn(file, args, { shell: false }) using a quote-aware parsed argv, and SandboxPolicy.isCommandAllowed and the new SandboxPolicy.tokenizeCommand reject unquoted shell metacharacters and unterminated quotes before the allowlist glob match.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online