CVE-2026-109331 Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP...

CVE-2026-73614

Network-AI ClaudeHookBridge prior to 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code uses the full untruncated command. This discrepancy permits attackers to place dangerous content beyond the 500-byte threshold in a Bash command field to byp...

CVE-2026-73614 Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list a...

CVE-2026-73614 Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list a...

PT-2026-71442

Name of the Vulnerable Software and Affected Versions Network-AI ClaudeHookBridge versions prior to 5.15.1 Description An issue exists where the software truncates the target string to 500 characters before evaluating denyPatterns, whereas Claude Code executes the full untruncated command. This...