Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist ("SandboxPolicy.isCommandAllowed"), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but "ShellExecutor" runs that string through "/bin/sh -c". So any wildcard allow such as "git *", "npm *" or "node *" also matches "git status; <anything>", and a scoped command becomes arbitrary execution. The issue is fixed in v5.9.1. "ShellExecutor" now executes via "spawn(file, args, { shell: false })" using a quote-aware parsed argv, so no shell is invoked. "SandboxPolicy.isCommandAllowed" and the new "SandboxPolicy.tokenizeCommand" reject any unquoted shell metacharacter ("; & | $ " " " ( ) < > { }"newline) or unterminated quote before the allowlist glob match; quoted metacharacters are preserved as literal argument data. Users should upgrade to"network-ai@5.9.1"or later. As defense in depth, avoid broad wildcard allowlist entries such as"node *"/"npm *` which are direct code execution by design.