CVE-2026-109331 is a high severity security control bypass (CVSS 7.4) in the npm package network-ai. The ClaudeHookBridge PreToolUse hook matches deny patterns against only the first present field of a tool call, so a prompt injected agent can put dangerous content in another field. Fixed in 5.15.2.
What's affected
The record says Network-AI from 5.14.0 before 5.15.2 is affected. The GitHub advisory GHSA-9p2w-prp8-5722, published on 27 September 2026 and rated High, lists the npm package network-ai with affected versions from 5.14.0 up to and including 5.15.1 and a patched version of 5.15.2. The sources agree.
The weakness is CWE-436, interpretation conflict. The vector is local, high attack complexity, no privileges, no interaction, with high confidentiality, integrity and availability impact.
The component is the operator facing gate for a Claude Code coding agent. The advisory says deny patterns are checked first and, in the default observe mode, are the only hard block. The target string they are matched against comes from a function that returns the first present field from a fixed list, such as command, file path or url, and falls back to the whole input only when none of those fields exist.
You are affected if you use Network-AI hooks with a coding agent and rely on deny patterns to stop dangerous writes or script execution.
How to check if you're exposed
Find the installed version:
npm ls network-ai
Versions from 5.14.0 to 5.15.1 need the upgrade. Then look at your hook configuration. If you copied the shipped example hook configuration for Claude Code, you use the affected gate. Review the deny patterns you set and ask whether any of them is meant to catch content in a field other than the path or command.
It is also worth checking what the agent can reach. A deny list is the last line, and it is only as good as the permissions underneath. Review which tools, MCP servers and directories the agent can use, and whether it runs under an account that can write to a web root.
What to do now
- Upgrade network-ai to 5.15.2 or later and restart the agent hooks.
- Do not rely on deny patterns alone: switch from observe mode to an enforcing mode where your version allows it, and use allow lists for tools and paths.
- Run coding agents in a sandbox without access to production credentials or web roots.
- Limit which MCP tools the agent can call and review any tool that executes scripts.
- Review agent logs for tool calls that carry a long content or script field next to a harmless looking path or command.
Why it matters
A guard is only as strong as what it looks at. This gate was meant to inspect the whole tool call, but the code took the first matching field and stopped. For a write call, the file path is always present, so the file contents were never examined. A deny pattern aimed at dangerous content could never see it.
This is a form of interpretation conflict. The people who wrote the rules assumed the whole input was checked, while the code checked a slice. The advisory notes that the maintainers had earlier stated an intent to match the full tool input, so the fix is to make the behaviour match the intent.
The wider lesson is for anyone building controls around AI agents. A prompt injected agent will present dangerous input in whatever shape slips past a filter. Pattern matching on text is a weak control compared with limiting what the agent can do at all. The record does not mark this CVE as known exploited.
Try it yourself
See how this kind of finding shows up in a dependency workflow.
Click through it at your own pace, or open it full screen.
Quick check
Is a deny list enough to control a coding agent?
The advisory shows how a deny list can miss content. Treat it as one layer, with sandboxing and allow lists as stronger controls.
Which versions are affected?
5.14.0 up to and including 5.15.1. Version 5.15.2 is the fix.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
