---
title: "CVE-2026-54051: Network-AI: Improper Neutralization of Special Elements used in an OS Command"
url: https://erroneo.us/security/cve/CVE-2026-54051/
description: "CVE-2026-54051 (network-ai (npm)): Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-07-20
date_modified: 2026-07-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-54051"
kev: false
cvss: 9.9
epss: 0.00666
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-54051: Network-AI: Improper Neutralization of Special Elements used in an OS Command

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.7% , percentile 51: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 51% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes network-ai (npm) < 5.9.1, fixed in 5.9.1 . Check your lockfile, including transitive dependencies.

## What it is

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (SandboxPolicy.isCommandAllowed), which THREATMODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but ShellExecutor runs that string through /bin/sh -c. So any wildcard allow such as git , npm or node also matches git status; , and a scoped command becomes arbitrary execution. The issue is fixed in v5.9.1. ShellExecutor now executes via spawn(file, args, { shell: false }) using a quote-aware parsed argv, so no shell is invoked. SandboxPolicy.isCommandAllowed and the new SandboxPolicy.tokenizeCommand reject any unquoted shell metacharacter (; & | $ ( ) { } newline) or unterminated quote before the allowlist glob match; quoted metacharacters are preserved as literal argument data. Users should upgrade to network-ai@5.9.1 or later. As defense in depth, avoid broad wildcard allowlist entries such as node / npm which are direct code execution by design.

## Affected packages

- npm `network-ai` < 5.9.1 → fixed: 5.9.1

## Affected products (CVE record)

- Jovancoding Network-AI: < 5.9.1

## Severity

- GitHub_M CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.67% probability of exploitation activity in the next 30 days; percentile 51.

## Sources

- [GitHub Advisory GHSA-qw6v-5fcf-5666](https://github.com/advisories/GHSA-qw6v-5fcf-5666)
- [CVE.org record CVE-2026-54051](https://www.cve.org/CVERecord?id=CVE-2026-54051)
- [NVD entry CVE-2026-54051](https://nvd.nist.gov/vuln/detail/CVE-2026-54051)
- [github.com](https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qw6v-5fcf-5666)
- [github.com](https://github.com/Jovancoding/Network-AI/commit/379f77656b578144e03415c5b134d8309a4b5792)

---
Source page: https://erroneo.us/security/cve/CVE-2026-54051/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt