Description
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
Published: 2026-07-15
Score: 10 Critical
EPSS: 2.4% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in 9Router versions 0.4.30 through 0.4.36, where the middleware protecting /api/cli‑tools/* and /api/mcp/* was absent. This allowed unauthenticated users to register custom plugins via src/app/api/cli‑tools/cowork‑settings/route.js and then execute commands through the MCP bridge, leading to remote code execution. The weakness involves lack of authentication (CWE‑306) and operating‑system command injection (CWE‑78).

Affected Systems

The impacted product is 9Router from the vendor decolua. Versions 0.4.30 through 0.4.36 were vulnerable, and the issue was fixed starting with version 0.4.37. No other versions are listed as affected.

Risk and Exploitability

With a CVSS score of 10, the vulnerability offers a fully exploitable remote code execution path. The EPSS score of 2% indicates a low likelihood of exploitation, and the flaw has not yet appeared in the CISA KEV catalog. Attackers can reach the vulnerable endpoints via standard HTTP requests to the 9Router service, requiring no special network permissions beyond access to the exposed routes.

Generated by OpenCVE AI on August 3, 2026 at 03:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade 9Router to version 0.4.37 or later to apply the vendor‑supplied fix.
  • If an upgrade is not immediately possible, block all traffic to /api/cli‑tools/* and /api/mcp/* using a firewall or reverse‑proxy, effectively disabling the vulnerable paths.
  • Review any custom plugins that have been installed; remove untrusted or unnecessary plugins and ensure that plugin configurations cannot be altered through unauthenticated endpoints.

Generated by OpenCVE AI on August 3, 2026 at 03:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-fhh6-4qxv-rpqj 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
History

Thu, 16 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Decolua
Decolua 9router
Vendors & Products Decolua
Decolua 9router

Wed, 15 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
Title 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Weaknesses CWE-306
CWE-78
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Decolua 9router
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-16T12:55:46.031Z

Reserved: 2026-05-13T18:37:30.990Z

Link: CVE-2026-46339

cve-icon Vulnrichment

Updated: 2026-07-16T12:55:39.939Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T03:15:05Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')