Threat Intelligence Database

Network-AI versions from 5.14.0 up to but not including 5.15.2 have a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook. This vulnerability arises because deny patterns are only matched against the first candidate field, allowing prompt-injected agents to evade these patterns by placing malicious payloads in other fields. This can lead to unauthorized writing of web shells or execution of scripts.

Jovancoding Network-AI versions 5.0.0 up to but not including 5.15.2 contain a cross-site WebSocket hijacking vulnerability in the DashboardServer component. The vulnerability arises because the handleUpgrade function does not perform Origin or token validation, allowing remote attackers to trick a victim's dashboard into opening a malicious WebSocket connection. This can lead to unauthorized disclosure of live agent topology information including agent IDs, roles, task descriptions, and token budgets. The CVSS 4.0 base score is 5.3, indicating a medium severity.

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.ts:254`) to return `true` unconditionally for every request — no `Authorization` header is required. Simultaneously, `_handleRequest` sets `Access-Control-Allow-Origin: *` (`lib/mcp-transport-sse.ts:272`) on every response, so a cross-origin browser fetch can read the result without restriction. An unauthenticated attacker who can lure a user to a malicious web page can invoke all 22 exposed MCP tools — including `config_set`, `agent_spawn`, and `blackboard_write` — against a default-configured localhost server. Version 5.4.5 patches the issue.

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.

Jovancoding Network-AI versions 5.7.1 and earlier contain a critical vulnerability where the MCP SSE server defaults to an empty secret, allowing unauthenticated invocation of all 22 MCP tools. This flaw permits any non-browser client to execute critical functions without credentials. The issue was partially mitigated in version 5.4.5 by restricting CORS to localhost, but the empty secret and authorization bypass remained until fixed in version 5.7.2.