9router CVE-2026-108593

Requires an authenticated 9router dashboard account with privileges to call POST /api/cli-tools/hermes-settings (PR:H) - the flaw is not reachable by unauthenticated attackers. The attacker must supply a baseUrl value containing double quotes and newline characters to break out of the intended field and inject the hooks_auto_accept flag and a hooks.post_llm_call shell command into the Hermes Agent config.yaml. Code execution does not occur immediately: it is gated on the Hermes Agent subsequently performing an LLM call (UI:P/AT:P), at which point the injected post_llm_call command runs without approval. Limiting factors: valid high-privilege dashboard credentials, a reachable/exposed dashboard, and an agent that actually issues an LLM call to trigger the payload.

This is a genuine remote code execution issue (CWE-94 configuration/code injection) but its real-world priority is tempered by several gating factors. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P, score 7.3, HIGH) is internally consistent with the description: network-reachable HTTP endpoint (AV:N), but requiring high privileges (PR:H - an authenticated dashboard user), a passive user-interaction/attack-requirement condition (UI:P/AT:P - the injected shell command only fires after the Hermes Agent performs an LLM call), yielding full high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H) with no scope change (SC:N/SI:N/SA:N). No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no signal of active or probable exploitation; however, the references include a detailed hackMD technical write-up and line-level source pointers, which materially lowers the bar to reproduce. The signals are coherent rather than conflicting - this is a real, patch-worthy RCE, but it is an authenticated post-exploitation / privilege-to-RCE vector in a niche product, not a mass-exploitable internet-facing bug. Net: moderate priority, highest for operators who expose the 9router dashboard to untrusted or multi-tenant users.

An attacker who already holds authenticated access to the 9router dashboard (e.g., a low-trust tenant or a compromised dashboard credential) sends a POST to /api/cli-tools/hermes-settings with a baseUrl value containing embedded double quotes and newlines. This injects hooks_auto_accept and a hooks.post_llm_call shell command into the Hermes Agent config.yaml, and the next time the agent performs an LLM call the injected command executes on the host without approval. A public hackMD technical write-up with source-line references exists, so reproduction is realistic, though no packaged exploit code was indicated in the input.