CVE-2026-73614 Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation
Attackers bypass deny patterns by placing malicious commands beyond the 500-character truncation limit, enabling arbitrary code execution in Claude Hook Bridge.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73614?
CVE-2026-73614 is a high-severity vulnerability in Jovancoding Network-AI, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.
Weakness: CWE-436
Which versions are affected by CVE-2026-73614?
How do I fix CVE-2026-73614?
No fix has been published for CVE-2026-73614 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73614 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73614 exists.
Sources
Also known as GHSA-64vj-7c55-24w2, GHSA-743h-jr5x-mpcr.