CVE-2026-109331: Interpretation Conflict in Jovancoding Network-AI

CVE-2026-109331 describes a security control bypass in Jovancoding's Network-AI product affecting versions >=5.14.0 and <5.15.2. The vulnerability exists in the ClaudeHookBridge PreToolUse hook, which applies deny pattern matching only to the first candidate field. An attacker can exploit this by injecting prompts that place dangerous payloads in other fields such as Write content or MCP script parameters alongside benign fields like file_path or command. This selective matching allows evasion of denyPatterns, enabling potentially malicious actions like writing web shells or executing scripts.

The vulnerability allows attackers to bypass security controls designed to block dangerous payloads, potentially leading to unauthorized code execution or web shell deployment. This could compromise the affected system's integrity and security. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates and apply any forthcoming patches promptly.