CVE-2026-109331 in Network-AI
Summary
by MITRE • 10/12/2026
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within Network-AI versions 5.14.0 through 5.15.2 represents a critical security control bypass rooted in flawed input validation logic within the ClaudeHookBridge PreToolUse hook mechanism. This component is designed to intercept and sanitize tool usage requests before they are executed, serving as a primary defense layer against malicious operations initiated by AI agents or external users. The core technical flaw lies in how the system evaluates deny patterns against incoming parameters. Specifically, the security control only inspects the first present candidate field within a request payload rather than iterating through all available fields or performing a holistic analysis of the entire input structure. This incomplete validation strategy creates a predictable blind spot that attackers can systematically exploit to bypass content filtering and access controls.
From an operational perspective, this flaw enables sophisticated prompt injection attacks where malicious actors can embed dangerous payloads in secondary parameters while keeping primary parameters benign to satisfy superficial checks. For instance, an attacker might construct a request with a safe file_path or command string in the first field, which passes the initial deny pattern check. Simultaneously, they place executable code, such as web shell scripts or arbitrary commands, within subsequent fields like Write content or MCP script parameters. Because the security hook fails to validate these additional fields against the same restrictive patterns, the malicious payload is allowed through and executed by the underlying system. This effectively neutralizes the intended protective measures of the PreToolUse hook, allowing unauthorized code execution with the privileges granted to the Network-AI service account.
The impact of this vulnerability extends beyond simple data leakage or denial of service. By successfully writing web shells or executing arbitrary scripts on the host infrastructure, an attacker gains a persistent foothold within the environment. This can lead to full system compromise, lateral movement across connected networks, and exfiltration of sensitive data processed by the AI agent. The ability to bypass security controls via parameter manipulation highlights a fundamental weakness in how complex tool calls are sanitized, particularly when multiple parameters are involved. Such attacks align with common adversarial techniques where input validation is circumvented through obfuscation or structural exploitation rather than direct pattern matching evasion.
This issue maps directly to CWE-20 Improper Input Validation and CWE-839 Sliver in Lock Mechanism if the bypass allows unauthorized access, though it most closely resembles CWE-749 Exposed Dangerous Method with Insufficient Protection due to the failure of security controls on specific inputs. In terms of MITRE ATT&CK framework tactics, this vulnerability facilitates Command and Control via remote scripting as well as Execution through user interaction or automated agent actions. The exploitation vector is typically classified under T1059 Command and Scripting Interpreter if scripts are executed directly, or potentially T1648 Server Side Request Forgery depending on how the injected payloads interact with internal services.
To mitigate this risk, immediate updates to Network-AI version 5.15.2 or later are required as these versions address the validation logic flaw in the ClaudeHookBridge PreToolUse hook. Until patching is applied, administrators should implement strict input sanitization at the application layer before requests reach the AI engine. This includes enforcing allow-lists for all parameter fields rather than relying solely on deny lists that may be bypassed by multi-field manipulation. Additionally, deploying a Web Application Firewall with rules capable of detecting anomalous patterns across multiple parameters in tool calls can provide an additional layer of defense. Monitoring logs for unusual combinations of benign and suspicious parameters in AI agent requests will also aid in early detection of exploitation attempts targeting this specific vulnerability.