CVE-2026-54051 Details
Description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but `ShellExecutor` runs that string through `/bin/sh -c`. So any wildcard allow such as `git *`, `npm *` or `node *` also matches `git status; <anything>`, and a scoped command becomes arbitrary execution. The issue is fixed in v5.9.1. `ShellExecutor` now executes via `spawn(file, args, { shell: false })` using a quote-aware parsed argv, so no shell is invoked. `SandboxPolicy.isCommandAllowed` and the new `SandboxPolicy.tokenizeCommand` reject any unquoted shell metacharacter (`; & | $ ` ` ` ( ) < > { }` newline) or unterminated quote before the allowlist glob match; quoted metacharacters are preserved as literal argument data. Users should upgrade to `[email protected]` or later. As defense in depth, avoid broad wildcard allowlist entries such as `node *` / `npm *` which are direct code execution by design.
A command injection vulnerability has been identified in Network-AI, a TypeScript/Node.js multi-agent orchestration tool. This issue affects versions prior to 5.9.1. The vulnerability arises because the agent sandbox's command allowlist, managed by `SandboxPolicy.isCommandAllowed`, fails to properly restrict shell commands. While the allowlist is intended to control a compromised agent's actions, it can be bypassed. The allowlist glob-matches the entire command string, but `ShellExecutor` executes it through `/bin/sh -c`, allowing injected commands to be executed. For example, a command allowlisted as `git *` could be exploited by appending `git status; id`, effectively executing the injected `id` command. This vulnerability undermines the control designed to manage compromised agents, as detailed in the project's threat model.
Users are advised to upgrade to Network-AI version 5.9.1 or later, where this vulnerability has been fixed. In version 5.9.1, the `ShellExecutor` executes commands without invoking a shell, using a parsed argument format that prevents shell metacharacters from being interpreted as commands. Additionally, the allowlist command policy has been improved to reject any unquoted shell metacharacters or unterminated quotes before matching against the allowlist.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qw6v-5fcf-5666 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Jovancoding/Network-AI/commit/379f77656b578144e03415c5b134d8309a4b5792 | [email protected] | Source CodeVendor |
| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qw6v-5fcf-5666 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Network-AI | < 5.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |