CVE-2026-62312

🗓️ 15 Jul 2026 20:53:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 90 Views🌐 WEB

Authenticated RCE in nine router via unvalidated MCP plugin arguments and localhost bypass; fixed in 0.5.2.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-62312	15 Jul 202620:53	–	attackerkb
Circl	CVE-2026-62312	15 Jul 202622:00	–	circl
Cvelist	CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments	15 Jul 202620:53	–	cvelist
EUVD	EUVD-2026-44814	15 Jul 202620:53	–	euvd
Mend	CVE-2026-62312	15 Jul 202620:53	–	mend
NVD	CVE-2026-62312	15 Jul 202621:16	–	nvd
osv_cve	CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments	15 Jul 202620:53	–	osv_cve
Positive Technologies	PT-2026-60306	15 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-62312: Improper Neutralization of Special Elements used in an OS Command	15 Jul 202600:00	–	rapid7
Snyk	Command Injection	15 Jul 202622:29	–	snyk

Vulners

Node

decolua 9routerRange<0.5.2

[
  {
    "vendor": "decolua",
    "product": "9router",
    "versions": [
      {
        "version": "< 0.5.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/decolua/9router/security/advisories/GHSA-63p9-g54h-prrp
github	www.github.com/decolua/9router/commit/da667836cc7584bea0edd893de1d590c9ea279dc
github	www.github.com/decolua/9router/releases/tag/v0.5.2

Parameter	Position	Path	Description	CWE
plugin args	nested	/api/mcp//sse	Remote authenticated attacker can achieve arbitrary code execution by bypassing localhost-only route restrictions via Host header and providing unvalidated MCP plugin arguments passed to child_process.spawn().	CWE-78

24 Oct 2026 21:10Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.18.8

EPSS0.00924

SSVC

CWE-78