NetworkAI SandboxPolicy Command Injection Bypass via Quote/Whitespace Mismatch

Vulnerability Overview Vulnerability Name: SandboxPolicy blocklist and approval-gate bypass via quote/whitespace mismatch between matchers and tokenized executor Description: The security matchers ( blocklist glob, , ) in Network AI evaluate the raw command string, while the executor normalizes the command string via . Since quotes and redundant spaces are treated as literal characters in blocklist matchers but are semantically invisible to the tokenized executor, this leads to: A controlled agent being able to construct a command that evades the "always-wins" blocklist/safety net, and Bypassing the human approval gate while the executor runs the same dangerous parameters. Root Cause: (blagent-runtime.ts:336) rejects untokenized metacharacters via , then calls (trimmed, this.config.blockedCommands) (350) and (trimmed, allowedCommands) (356) on the raw command string. (378) runs on the raw string. (383) also checks the raw string. -> (465-474) compiles patterns into anchored regular expressions; literal quote characters in the value break the match. The executor (544-547, .892-916) calls -> , stripping quote characters (239-243) and collapsing spaces, generating actual arguments that are executed via . Impact: Matchers see a quoted destructive command (no blocklist hit), while the executor runs the unquoted argument form. Impact Scope Affected Versions: Fixed Version: CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Remediation Recommended Fix: Run matchers against the normalized (or per-token), i.e., the same normalized argument form that the executor runs. This applies the same remediation principle as CVE-2026-54051 (for the chain vector) extended to security matchers. POC Code Attack Chain Chain A - Blocklist Bypass (Destructive Command) 1. Entry: , operator allow list includes . - Guard: rejects untokenized metacharacters. Bypass proof: and are not metacharacters; strips quotes/collapses spaces -> -> passes. 2. Check (Blocklist, agent-runtime.ts:350): , where blocklist contains recursive deletion entries. - Guard: "always wins" and must unconditionally block destructive commands. - Bypass Proof: Blocklist entry for returns false for quoted strings (literal character breaks the anchored regex), allowing to still match -> returns true. 3. Sink (544-557): strips quotes -> -> . 4. Impact: Flag entry of blocklist is bypassed; destructive command runs. Audit logs record the deceptive quoted string. Chain B - Approval Gate Bypass 1. Entry: , operator allow list includes . - Guard: rejects metacharacters. Bypass proof: quotes are not metacharacters; passes, . 2. Check (Allowed): -> true ( matches raw string without quotes). 3. Check (Approval, 899 -> requiresApproval): . - Guard: blocks in list; -> false ( between and breaks literal match) -> -> false -> short-circuits at 300, requiring no approval. 4. Sink: -> -> runs push unsupervised. Bypass Evidence Against actual v5.15.0 source functions ( , , , , ): - Quoted recursive deletion strings return / blocklist miss/fail, while tokenized args are unquoted destructive forms; double-space variants also bypass blocklist; runs -false while tokenized args are true privileged commands. Baseline (unquoted form) correctly blocks/correctly requires approval. - Scope precision: / approval patterns are not bypassable: immediately follows base token, so quoted args still match. Bypassable approval patterns: , , , , plus the entire list. Affected Versions (verified on latest release tag v5.15.0 and HEAD, matchers still run on while strips quotes). Recommended Fix Run matchers against the normalized (or per-token), i.e., the same normalized argument form that the executor runs. This applies the same remediation principle as CVE-2026-54051 (for the chain vector) extended to security matchers. Reporter Reported by zx (Jace) - GitHub: @manus-use

Goal Reached Thanks to every supporter — we hit 100%!

NetworkAI SandboxPolicy Command Injection Bypass via Quote/Whitespace Mismatch

More from this source