PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64622 Jovancoding CVE debrief

The Network-AI npm package, specifically versions 5.12.2 through 5.13.3, contains a critical vulnerability. This vulnerability fails to apply the configured authorization check to certain GET read routes, allowing unauthenticated actors to access sensitive approval request details. The affected routes include GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse. These routes disclose full ApprovalEntry content, including sensitive information such as action/target shell-command strings, file paths, justifications, and risk levels. Additionally, the responses include a hardcoded Access-Control-Allow-Origin: * header, which enables cross-origin disclosure from any website the operator visits.

Vendor
Jovancoding
Product
Network-AI
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-21
Advisory published
2026-07-20
Advisory updated
2026-07-21

Who should care

Users of the Network-AI npm package, particularly those who have installed versions 5.12.2 through 5.13.3, should be aware of this vulnerability. This vulnerability is considered critical with a CVSS score of 9.3. The vulnerability allows unauthenticated access to sensitive data, which could lead to unauthorized information disclosure and potential further exploitation.

Technical summary

The Network-AI npm package versions 5.12.2 through 5.13.3 have a vulnerability that bypasses the configured authorization check for certain ApprovalInbox GET read routes. This allows unauthenticated actors to access sensitive approval request details, including action/target shell-command strings, file paths, justifications, and risk levels. The vulnerability affects the following routes: GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse. Responses from these routes include a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure.

Defensive priority

High

Recommended defensive actions

  • Immediately update to a version of Network-AI that fixes this vulnerability.
  • Review and adjust the authorization configuration for ApprovalInbox routes.
  • Implement additional monitoring to detect potential exploitation attempts.
  • Restrict access to sensitive approval data through other means, such as IP whitelisting or VPN.
  • Consider replacing the Network-AI package with an alternative that does not have this vulnerability.

Evidence notes

The CVE record was published on 2026-07-20T12:19:47.057Z and was last modified on 2026-07-21T12:19:00.283Z. The NVD entry is currently Received. The vulnerability has a CVSS score of 9.3 and is considered CRITICAL.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64622 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64622

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64622 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64622

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.