CVE-2026-73615 describes a vulnerability in Jovancoding Network-AI where the SandboxPolicy component evaluates raw command strings including quotes, but the executor component tokenizes commands by removing quotes before execution. This interpretation conflict enables attackers to bypass security checks by submitting commands with quotes that evade blocklist and approval mechanisms, while the executor runs the equivalent unquoted dangerous commands. The vulnerability affects versions prior to 5.15.1, although no explicit affected versions were provided in the input data. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with low privileges can remotely execute commands that bypass security matcher checks and approval gates, potentially leading to unauthorized command execution with high impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, users should monitor vendor communications for updates and consider additional manual command validation controls if feasible.