PatchSiren cyber security CVE debrief
CVE-2026-64622 Jovancoding CVE debrief
The Network-AI npm package, specifically versions 5.12.2 through 5.13.3, contains a critical vulnerability. This vulnerability fails to apply the configured authorization check to certain GET read routes, allowing unauthenticated actors to access sensitive approval request details. The affected routes include GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse. These routes disclose full ApprovalEntry content, including sensitive information such as action/target shell-command strings, file paths, justifications, and risk levels. Additionally, the responses include a hardcoded Access-Control-Allow-Origin: * header, which enables cross-origin disclosure from any website the operator visits.
- Vendor
- Jovancoding
- Product
- Network-AI
- CVSS
- CRITICAL 9.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-21
Who should care
Users of the Network-AI npm package, particularly those who have installed versions 5.12.2 through 5.13.3, should be aware of this vulnerability. This vulnerability is considered critical with a CVSS score of 9.3. The vulnerability allows unauthenticated access to sensitive data, which could lead to unauthorized information disclosure and potential further exploitation.
Technical summary
The Network-AI npm package versions 5.12.2 through 5.13.3 have a vulnerability that bypasses the configured authorization check for certain ApprovalInbox GET read routes. This allows unauthenticated actors to access sensitive approval request details, including action/target shell-command strings, file paths, justifications, and risk levels. The vulnerability affects the following routes: GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse. Responses from these routes include a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure.
Defensive priority
High
Recommended defensive actions
- Immediately update to a version of Network-AI that fixes this vulnerability.
- Review and adjust the authorization configuration for ApprovalInbox routes.
- Implement additional monitoring to detect potential exploitation attempts.
- Restrict access to sensitive approval data through other means, such as IP whitelisting or VPN.
- Consider replacing the Network-AI package with an alternative that does not have this vulnerability.
Evidence notes
The CVE record was published on 2026-07-20T12:19:47.057Z and was last modified on 2026-07-21T12:19:00.283Z. The NVD entry is currently Received. The vulnerability has a CVSS score of 9.3 and is considered CRITICAL.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:47.057Z and has not been modified since then. The NVD entry is currently Received.