Network-AI versions before 5.9.1 implement a command allowlist that glob-matches entire command strings but execute them through /bin/sh -c, which allows shell metacharacters to enable command injection. For example, an allowlist entry like 'git *' matches 'git status; <anything>', permitting arbitrary command execution. The vulnerability is addressed in version 5.9.1 by switching to spawn(file, args, { shell: false }) to avoid shell invocation and by enhancing the allowlist to reject unquoted shell metacharacters or unterminated quotes before matching. Quoted metacharacters are preserved as literal arguments. Users are advised to upgrade to 5.9.1 or later and avoid broad wildcard allowlist entries such as 'node *' or 'npm *' which inherently allow code execution.

Successful exploitation allows an attacker with at least limited privileges (PR:L) to execute arbitrary OS commands with the privileges of the Network-AI agent. This can lead to complete system compromise (confidentiality, integrity, and availability impacts are all high). The vulnerability is critical with a CVSS score of 9.9, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in Network-AI version 5.9.1 and later. Users should upgrade to version 5.9.1 or newer to eliminate this vulnerability. Additionally, as a defense in depth measure, users should avoid broad wildcard allowlist entries such as 'node *' or 'npm *' because these inherently allow arbitrary code execution by design. No other vendor advisories indicate alternative mitigations or no-action requirements.