What happened
NVD published CVE-2026-73614 and CVE-2026-73615 (both CVSS 8.8, High) on 2026-08-13, describing two distinct bypasses of Claude Code's Bash-command security policy enforcement in the ClaudeHookBridge plugin — one via string truncation before deny-pattern matching, one via quote-handling mismatch between the policy matcher and the executor.
Why it matters
These are agent-guardrail bypass vulnerabilities in a security layer specifically built to constrain what commands an AI coding agent can execute — defeating the very control meant to prevent dangerous command execution by Claude Code, a widely used AI coding agent.
Attack vector
ClaudeHookBridge truncates the target command string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command; attackers position dangerous content past byte 500 in a Bash command field to bypass the deny-list. A related flaw (CVE-2026-73615, CVSS 8.8) has SandboxPolicy evaluate quoted commands while the executor strips quotes before execution, allowing quoted-command evasion of blocklist checks
Affected systems
Network-AI ClaudeHookBridge < 5.15.1
Mitigation
Upgrade to Network-AI ClaudeHookBridge 5.15.1 or later