CyberRota Analysis
AI-GeneratedThe vulnerability affects Network-AI ClaudeHookBridge versions prior to 5.15.1, where the target string is truncated to 500 characters before evaluating denyPatterns, allowing attackers to bypass security controls. This flaw enables the execution of arbitrary commands by positioning malicious content beyond the truncation limit in a Bash command field. Organizations utilizing affected versions of ClaudeHookBridge should prioritize patching to mitigate the risk of command injection attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.