Description

Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T12:17:26.337Z",
  "pubdate": "2026-08-13T12:17:26.337Z",
  "executiveSummary": "A security matcher bypass vulnerability exists in Network-AI versions before 5.15.1, potentially allowing attackers to evade security controls and execute unauthorized commands.\nThe vulnerability arises from a parsing discrepancy between the SandboxPolicy evaluation mechanism and the command executor.\nSpecifically, SandboxPolicy evaluates raw command strings while preserving quotes, whereas the executor tokenizes commands by stripping quotes prior to execution.\nAn attacker capable of supplying crafted quoted command strings can successfully bypass established blocklist checks and approval gates.\nUpon successful exploitation, the underlying executor runs the unquoted dangerous argv, leading to unauthorized command execution and potential compromise of affected systems.\nThe risk implication is severe, as security policies intended to restrict dangerous operations can be entirely circumvented without triggering defensive alarms.",
  "technicalDetails": "The root cause of this vulnerability is an input sanitization and normalization inconsistency between security policy validation and actual command execution components within Network-AI.\nThe vulnerable components involve the SandboxPolicy evaluation engine and the command execution subsystem.\nDuring the policy evaluation phase, SandboxPolicy analyzes raw command strings while retaining quotation marks. Security matchers, blocklists, and approval gates rely on these quoted representations to determine whether a command is permitted.\nHowever, the downstream executor tokenizes the incoming command string by stripping quotes immediately before final execution.\nAn attacker exploits this behavioral mismatch by crafting input containing specific quotation marks. When the SandboxPolicy inspects the command, the presence of quotes alters the string representation such that it does not match signatures in the blocklist, thereby evading security matchers and approval workflows.\nOnce the policy evaluation phase grants authorization based on the quoted string, the executor strips the quotation marks, resulting in the execution of the identical unquoted dangerous argv that the security policy was originally designed to block.\nThis discrepancy enables complete circumvention of security controls, allowing unauthorized operations to be processed by the underlying operating system or application runtime.\nAffected versions include all deployments of Network-AI prior to version 5.15.1."
}