Remote code execution in 9router via MCP plugin argument injection (CVE-2026-63732)

9router v0.4.59 contains a chain of three vulnerabilities that together allow a remote, unauthenticated attacker to achieve arbitrary code execution on the host operating system with no operator interaction required. The chain exploits a hardcoded default password (123456) that authenticates any fresh installation, a LOCAL_ONLY network gate bypass via a spoofed Host header, and unvalidated arguments passed directly to child_process.spawn() when registering MCP plugins. An attacker can log in with the default credential, spoof Host: localhost:20128 to reach local-only routes including the MCP plugin registration endpoint, and supply node with arbitrary -e arguments that execute when the plugin's SSE endpoint is triggered. Affected versions: - 0.4.59 We recommend updating to: 0.4.60. CVSS 9.4 · our assessment: act_now Reference: https://github.com/decolua/9router/security/advisories/GHSA-4922-8r65-fq26 Details: https://vuln.today/cve/CVE-2026-63732