CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to childprocess.spawn, allowing...

User Impersonation

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to User Impersonation via manipulation of the Host header. An attacker can gain unauthorized access to the /v1 proxy and trigger server-side requests to internal or cloud-metadata...

CVE-2026-59800

9router prior to 0.4.44 is affected by an OS command injection via the unauthenticated POST /api/tunnel/tailscale-install endpoint. The vulnerability arises from piping the sudoPassword field from the request into a sudo -S sh child process, where, under conditions such as root execution, NOPASSW...

CVE-2026-10269 decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization

A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be...