What happened
Network-AI's ClaudeHookBridge PreToolUse hook is intended to block dangerous tool actions by deny patterns, but it evaluates only the first present candidate field. A prompt-injected agent can place malicious content in fields the matcher skips — such as Write content or an MCP script parameter — while supplying a benign file_path/command, evading the deny list to write web shells or execute scripts.
Why it matters
This is a safety-control bypass in the hook layer that administrators place between an agent and its tools. When prompt injection reaches the agent, the deny list — the last line of defense — silently does not fire, converting injection into filesystem write / script execution.
Attack vector
The PreToolUse hook matches deny patterns only against the first present candidate field. A prompt-injected agent places the dangerous payload in a field the matcher does not inspect (e.g. Write content or an MCP script parameter) beside a benign file_path/command, evading denyPatterns.
Affected systems
Network-AI (Jovancoding) 5.14.0 <= version < 5.15.2 (ClaudeHookBridge PreToolUse) — also CVE-2026-109330/109332 in the same release
Mitigation
Upgrade to Network-AI 5.15.2 (GHSA-9p2w-prp8-5722). Audit the hook to match deny patterns against every candidate field.