Network-AI: Improper Neutralization of Special Elements used in an OS Command
Date: 2026-06
Affected: npm/network-ai
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-54051
CWE: CWE-78
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

## Summary The agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but `ShellExecutor` runs that string through `/bin/sh -c`. So any wildcard allow such as `git *`, `npm *` or `node *` also matches `git status; <anything>`, and a scoped command becomes arbitrary execution. ## Root cause Matching and execution disagree on what a command is. Lines pinned to `40e42d7` (`lib/agent-runtime.ts` is identical to the v5.8.5 tag). 1. `isCommandAllowed` matches the full string, with no tokenizing and no metacharacter check: https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L248-L260 2. `globMatch` compiles `*` to `.*` and anchors it, so `git *` becomes `^git .*$` and matches `git status; id`: https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L353-L360 3. `ShellExecutor.execute` only checks `isCommandAllowed`, never `requiresApproval`: https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L387-L391 4. `spawnCommand` runs the approved string via `/bin/sh -c`, so `;`, `|` and `$(...)` are interpreted by the shell: https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L427-L431


Mitigations:

Architectural layers (MAESTRO):