What is CVE-2026-73614?
A security bypass vulnerability exists in Network-AI ClaudeHookBridge before version 5.15.1 where the `denyPatterns` check truncates the target string to 500 characters before evaluation. This allows attackers to bypass the hard-deny list by placing dangerous Bash commands after the 500th byte, as Claude Code executes the full untruncated command. Users should immediately update to version 5.15.1 or later.
Azərbaycanca: Network-AI ClaudeHookBridge-in 5.15.1-dən əvvəlki versiyalarında `denyPatterns` siyahısı `target` sətrini 500 simvoldan sonra kəsdiyi üçün təhlükəsizlik yan keçid zəifliyi mövcuddur. Bu, hücumçuya təhlükəli Bash əmrlərini 500-cü simvoldan sonra gizlədərək qadağa siyahısını keçməyə imkan verir. İstifadəçilər dərhal 5.15.1 və ya daha yuxarı versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-284
FAQ2
How can I protect against CVE-2026-73614?
Users of Network-AI ClaudeHookBridge should immediately update to version 5.15.1 or later.
Why is CVE-2026-73614 dangerous?
The vulnerability causes the `denyPatterns` list to only check the first 500 characters of the `target` string. This allows attackers to bypass the hard-deny list by placing dangerous Bash commands after the 500th character, as Claude Code executes the full untruncated command.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.