CVE-2026-54051 Network-AI has an an OS Command Injection issue
A compromised agent can execute arbitrary OS commands by bypassing the shell command allowlist via shell metacharacters in Network-AI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54051?
CVE-2026-54051 is a critical command injection vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but `ShellExecutor` runs that string through `/bin/sh -c`. So any wildcard allow such as `git *`, `npm *` or `node *` also matches `git status; <anything>`, and a scoped command becomes arbitrary execution. The issue is fixed in v5.9.1. `ShellExecutor` now executes via `spawn(file, args, { shell: false })` using a quote-aware parsed argv, so no shell is invoked. `SandboxPolicy.isCommandAllowed` and the new `SandboxPolicy.tokenizeCommand` reject any unquoted shell metacharacter (`; & | $ ` ` ` ( ) < > { }` newline) or unterminated quote before the allowlist glob match; quoted metacharacters are preserved as literal argument data. Users should upgrade to `[email protected]` or later. As defense in depth, avoid broad wildcard allowlist entries such as `node *` / `npm *` which are direct code execution by design.
Weakness: CWE-78
Which versions are affected by CVE-2026-54051?
2 open source packages ship an affected version, including network-ai.
| Package | Affected | Fixed in |
|---|---|---|
network-ai npm | All versions | 5.9.1 |
network-ai npm | All versions | 5.9.1 |
How do I fix CVE-2026-54051?
Upgrade network-ai to 5.9.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-54051 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54051 exists.
Sources
Also known as GHSA-qw6v-5fcf-5666.