CVE-2026-73615

Name of the Vulnerable Software and Affected Versions Network-AI versions prior to 5.15.1

Description A security matcher bypass exists because SandboxPolicy evaluates raw command strings with quotes preserved, whereas the executor tokenizes commands by stripping quotes before execution. This discrepancy allows attackers to craft quoted commands that evade blocklist checks and approval gates, while the executor subsequently runs the dangerous unquoted argv (argument vector).

Recommendations Update Network-AI to version 5.15.1 or later.