CVE-2026-64622
Network‑AI, a Node.js package, has a critical flaw that lets anyone read detailed approval requests without authentication. The bug affects versions 5.12.2 through 5.13.3 and also sends a wildcard CORS header, allowing any website to read the data. The flaw could expose shell commands, file paths, and risk levels.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Network‑AI npm package, versions 5.12.2 to 5.13.3, used by developers who rely on its approval inbox functionality.
Real-world impact
An attacker could read sensitive approval request details, including shell commands and file paths, and could use the data to plan further attacks or exfiltrate information.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability is exploitable over the network, requires no authentication, and can expose highly confidential data, making it a critical risk.
What to do about it
- ›Disable or restrict the GET /approvals routes or use a reverse proxy to block unauthenticated access.
- ›Remove the hardcoded Access-Control-Allow-Origin: * header or configure CORS to allow only trusted origins.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.