Network-AI is a TypeScript/Node.js orchestrator. Prior to version 5.9.1 the agent sandbox gated shell commands behind an allowlist. The allowlist performed a glob match against the entire command string, while the execution engine ran the string through /bin/sh -c. As a result any wildcard that matched, such as git * or npm *, also matched strings containing shell metacharacters, allowing an attacker to inject a complete shell command after the glob match. The flaw is a classic operating‑system command injection (CWE-78) and can lead to the execution of arbitrary OS commands on the host running a compromised agent.

All releases of Jovancoding Network‑AI before version 5.9.1 are vulnerable. Users running any of those versions, including the latest pre‑5.9.1 build, should verify their installed version and plan a prompt upgrade.

The CVSS score of 9.9 reflects critical severity, and the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector involves a misconfigured or malicious agent that uses broad wildcard allowlist entries; once such an entry matches, the attacker can inject shell metacharacters and execute arbitrary code through the /bin/sh -c shell. The exploitation would give the attacker full control over the host operating system.