What happened
NVD published CVE-2026-54051 (CVSS 9.9) on 2026-07-20 describing a sandbox-escape vulnerability in Network-AI, a TypeScript/Node.js multi-agent orchestrator, that defeats the project's documented primary control against a compromised agent (its own threat model's 'Adversary 3.2').
Why it matters
This directly defeats the core control that multi-agent orchestration frameworks rely on to contain a compromised or adversarially-prompted agent — an agent restricted to 'safe' allowlisted commands can pivot to full arbitrary command execution on the host, which is exactly the class of agent-execution attack the AI industry has been most concerned about for agentic deployments.
Attack vector
The agent sandbox's `SandboxPolicy.isCommandAllowed` glob-matches the whole command string against an allowlist, but `ShellExecutor` runs the matched string through `/bin/sh -c`. A wildcard allow entry like `git *` or `npm *` therefore also matches `git status; <anything>`, letting a compromised or malicious agent turn a scoped allowed command into arbitrary shell execution.
Affected systems
Network-AI (npm: network-ai), versions prior to 5.9.1
Mitigation
Upgrade to Network-AI v5.9.1 or later, which replaces shell invocation with `spawn(file, args, { shell: false })` using quote-aware argv parsing and rejects unquoted shell metacharacters before allowlist matching. As defense in depth, avoid broad wildcard allowlist entries.