EUVD-2026-48436

9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....

Command Injection

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Command Injection via unvalidated arguments passed to the childprocess.spawn function. An attacker can execute arbitrary commands on the host operating system by sending malicio...