High severity · published Aug 13, 2026
CVE-2026-73615
Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Network-AI · Jovancoding
before 5.15.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73615
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73615
github.com
https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-9v4f-j8cv-fhxw
www.vulncheck.com
https://www.vulncheck.com/advisories/network-ai-sandboxpolicy-before-blocklist-bypass-via-quote-mismatch
More from Network-AI
9.9
CVE-2026-54051
Network-AI has an an OS Command Injection issue
9.1
CVE-2026-48814
Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)
8.8
CVE-2026-73614
Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation
8.7
CVE-2026-42856
Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls
8.6
CVE-2026-64623
Network-AI before 5.13.4 Cryptographic Signature Verification Bypass