Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-73615 exploits a critical mismatch between security validation and command execution in Network-AI versions before 5.15.1. The SandboxPolicy component evaluates commands with quotes intact, allowing attackers to craft payloads like `"dangerous-command"` that pass blocklist checks. However, the executor strips quotes before execution, causing the identical dangerous command to run without restriction. This affects any organization deploying Network-AI for sandboxed command execution, particularly those relying on it for untrusted workload isolation or multi-tenant environments where quote-based evasion transforms a blocked command into an approved one.
While no MITRE ATT&CK techniques are formally mapped to this CVE, Casky's 754 security skills would detect attack patterns consistent with Defense Evasion (T1027 - Obfuscated Files or Information) and Execution (T1059 - Command and Scripting Interpreter) by analyzing the semantic gap between policy evaluation and runtime behavior. Practitioners using Casky would see findings highlighting quote-based command obfuscation attempts, policy enforcement bypasses where quoted variants of blocked commands slip through validation, and discrepancies between what security tools inspect versus what actually executes—patterns that indicate sandbox escape or approval gate circumvention rather than legitimate command usage.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-73615. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation