CVE-2026-73614: Jovancoding Network-Ai

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.

Affected products

• Jovancoding Network-Ai: before 5.15.1 (fixed in 5.15.1)

Published 2026-08-13. Last modified 2026-09-09.