{"action":"Upgrade network-ai to 5.4.5 or later.","affected":[{"fixed":"5.4.5","introduced":"0"}],"component":"network-ai","cve_ids":["CVE-2026-46701"],"ecosystem":"npm","epss":0.0021,"exploited":false,"fixed_versions":["5.4.5"],"ghsa_id":"GHSA-j3vx-cx2r-pvg8","id":"tcs_01M5KFWS6X5NKT5P7P644VGZMF","modified_at":"2026-07-08T08:29:24.200115859Z","published_at":"2026-05-21T22:39:59Z","references":["https://osv.dev/vulnerability/GHSA-j3vx-cx2r-pvg8","https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-j3vx-cx2r-pvg8","https://github.com/Jovancoding/Network-AI"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-j3vx-cx2r-pvg8","url":"https://osv.dev/vulnerability/GHSA-j3vx-cx2r-pvg8"}],"summary":"Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret"}