CyberRota Analysis
AI-GeneratedVersions of Network-AI prior to 5.15.1 are vulnerable to a security matcher bypass that allows attackers to evade blocklist checks by crafting quoted command strings. This flaw enables the execution of potentially harmful commands, as the system processes the commands differently during evaluation and execution. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.