Network-AI ClaudeHookBridge truncates user‑supplied target strings to 500 characters before evaluating its denyPatterns, but the underlying Claude code executes the full untruncated command. An attacker can place malicious characters just beyond the 500‑character limit in a Bash command field, thereby bypassing the hard‑deny list and forcing the system to run arbitrary shell commands. This flaw grants an attacker the ability to alter or discard confidentiality, integrity, and availability of the affected host, potentially compromising the entire system.

The vulnerability affects Jovancoding's Network‑AI ClaudeHookBridge product in all releases earlier than version 5.15.1.

The CVSS score of 8.7 classifies this as a high‑severity flaw; its EPSS score is currently unavailable, and it is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is remote exploitation via any interface that accepts command strings (for example, an API or web console). The attacker must be able to supply a Bash command field that contains dangerous content after the 500‑character boundary; no special privileges are required beyond access to that interface, making the issue openly exploitable in a suitable environment.