EUVD-2026-44814Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable authenticated user (PR:L) chains a reliable Host-header bypass (AC:L) into host command execution, yielding full C/I/A impact with no user interaction.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to child_process.spawn(), allowing malicious custom plugins to execute commands through /api/mcp//sse. This issue is fixed in version 0.5.2.
AnalysisAI
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the host by chaining a Host-header spoof (to reach routes that are supposed to be localhost-only) with unsanitized MCP plugin arguments that flow into child_process.spawn() via the /api/mcp//sse endpoint. Rated CVSS 8.8 (CWE-78, OS command injection), it is fixed in 0.5.2; no public exploit or CISA KEV listing exists at time of analysis, though a vendor advisory and fix commit are published.
Technical ContextAI
9Router is a Node.js self-hosted AI/LLM request router and token saver. The flaw sits at the intersection of two components confirmed by the fix commit: custom-server.js, which decides whether an inbound request is 'local' (loopback), and src/dashboardGuard.js, which gates localhost-only routes such as the MCP (Model Context Protocol) plugin interface. Because the guard trusted the socket/Host as loopback without accounting for reverse-proxy forwarding headers, a crafted Host header let an external request masquerade as local. The MCP plugin subsystem then passed attacker-influenced plugin arguments directly into Node's child_process.spawn(), the classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) sink, turning custom-plugin argument data into executable OS commands through the Server-Sent Events route /api/mcp//sse. CPE cpe:2.3:a:decolua:9router identifies the single affected product.
RemediationAI
Vendor-released patch: upgrade to 9Router 0.5.2 (https://github.com/decolua/9router/releases/tag/v0.5.2), which corrects the loopback-trust logic - the fix commit da667836cc7584bea0edd893de1d590c9ea279dc stamps an x-9r-via-proxy header when x-forwarded-for or x-real-ip are present and makes dashboardGuard.js treat such proxied requests as non-local, closing the Host-header bypass. Review the advisory at https://github.com/decolua/9router/security/advisories/GHSA-63p9-g54h-prrp before deploying. If immediate patching is not possible, compensating controls include: restrict network reachability of the 9Router instance and its localhost-only routes (bind to 127.0.0.1 and front only with a trusted proxy that strips client-supplied x-forwarded-for/x-real-ip and Host manipulation); block or filter access to the /api/mcp/ SSE endpoints at the proxy for untrusted clients; and disable or remove untrusted custom MCP plugins so attacker-controlled arguments cannot reach child_process.spawn(). Trade-offs: header stripping at the proxy can break legitimate multi-hop deployments if not scoped carefully, and disabling custom MCP plugins removes functionality relied upon by integrations.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today