Description

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T12:17:26.197Z",
  "pubdate": "2026-08-13T12:17:26.197Z",
  "executiveSummary": "A security vulnerability has been identified in Network-AI ClaudeHookBridge before 5.15.1, involving input truncation logic that leads to a security control bypass.\nThe flaw allows malicious actors to evade operator-configured hard-deny lists by manipulating the length of input strings.\nThe affected product is Network-AI ClaudeHookBridge in versions prior to 5.15.1.\nThe primary risk implication is the execution of arbitrary commands by bypassing intended security policies within the command execution pipeline.\nAn attacker possesses the capability to construct specially crafted Bash commands containing dangerous content positioned beyond the truncation threshold.\nSuccessful exploitation requires the ability to supply or influence input data processed by the vulnerable bridge component prior to command execution by Claude Code.",
  "technicalDetails": "The root cause of the vulnerability resides in a truncation mechanism within Network-AI ClaudeHookBridge before 5.15.1.\nThe vulnerable component truncates the target input string to a maximum length of 500 characters before evaluating it against the configured denyPatterns security rules.\nConversely, Claude Code subsequently processes and executes the full, untruncated command string supplied by the user or upstream process.\nThe attack flow proceeds as follows: an attacker crafts a malicious Bash command where legitimate or benign-appearing characters occupy the first 500 bytes of the input field to successfully pass the denyPatterns evaluation phase.\nThe attacker then appends the dangerous command payload past the 500-character boundary, ensuring it evades detection by the pattern-matching filter.\nUpon passing the truncated evaluation, the complete command string containing the hidden malicious payload is handed over to Claude Code for execution.\nBecause Claude Code executes the entire untruncated command, the unauthorized instructions are successfully executed on the underlying system, resulting in arbitrary command execution.\nThe affected versions include all releases of Network-AI ClaudeHookBridge prior to version 5.15.1."
}