EUVD-2026-48436
GHSA-qvg7-rqwf-6wmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Hardcoded default password makes it effectively unauthenticated (PR:N), the chain is reliable and low-effort (AC:L), and MCP plugins execute on the host OS beyond the app, so scope changes (S:C) with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin (e.g. node -e <payload>) to achieve arbitrary code execution on the host operating system when the plugin's SSE endpoint is triggered.
AnalysisAI
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded default password (123456) accepted on any fresh install, a Host-header spoof that defeats the LOCAL_ONLY network gate, and unsanitized arguments reaching child_process.spawn() during MCP plugin registration - to run arbitrary OS commands on the host. The issue is fixed in 0.4.60, was reported by VulnCheck, and carries a CVSS 4.0 base score of 9.4; no public exploit identified at time of analysis, though the advisory describes a directly reproducible attack path.
Technical ContextAI
9router is a routing/proxy service that supports MCP (Model Context Protocol) plugins, which it registers and launches as child processes. The root cause is CWE-78 (OS Command Injection): user-controllable plugin registration data (e.g. a command like 'node -e <payload>') is passed as unvalidated arguments to Node.js child_process.spawn(), so attacker-supplied input is executed by the host shell/runtime when the plugin's SSE (Server-Sent Events) endpoint is triggered. Two upstream weaknesses make this reachable remotely: authentication relies on a static default credential (CWE-798-style hardcoded password) rather than per-install secrets, and the LOCAL_ONLY access control trusts the client-supplied Host header, which is trivially forgeable, so 'local only' routes are exposed to remote clients. The single affected package per CPE is cpe:2.3:a:decolua:9router (all versions up to the 0.4.60 fix).
RemediationAI
Primary fix: upgrade to 9router 0.4.60, which the vendor released to remediate the chain, per GHSA-4922-8r65-fq26 (https://github.com/decolua/9router/security/advisories/GHSA-4922-8r65-fq26) and the VulnCheck advisory (https://www.vulncheck.com/advisories/9router-before-remote-code-execution-via-default-password). If immediate patching is not possible, change the default password (123456) to a strong unique credential on every install to close the trivial login, which stops the entry point at the cost of nothing but an admin step; enforce the LOCAL_ONLY restriction at the network layer rather than trusting the application's Host-header check - for example bind the service to 127.0.0.1/loopback or place it behind a firewall or reverse proxy that validates the true source address, accepting that this blocks legitimate remote administration; and disable or restrict MCP plugin registration for untrusted users so unvalidated commands cannot reach child_process.spawn(), with the trade-off that plugin functionality is lost until patched.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today