9router performs image URL validation by resolving the hostname before fetching, but the later server‑side fetch uses a separate DNS resolution. An attacker who can control DNS can first resolve a name to a public IP and then rebind it to an internal address. When an authenticated user accesses the LLM proxy with a vision‑capable model and supplies such a name, the router will fetch the image from the internal service, allowing the attacker to reach internal‑only HTTP endpoints. The primary impact is that an attacker gains the ability to send arbitrary requests to internal network services, potentially exposing internal data, leveraging privileged credentials, or pivoting further into the network.

The vulnerability exists in decolua:9router before version 0.5.2. Only those deployments running a pre‑0.5.2 build are affected; all later releases contain the fix.

The CVSS score of 7.4 indicates a medium‑to‑high severity. The EPSS score is below 1%, indicating a very low but non‑zero exploit probability. The issue is not listed in the CISA KEV catalogue. Exploitation requires an authenticated attacker with access to the LLM proxy; the attacker must set up a DNS name that rebinding to an internal address after an initial public resolution. Once achieved, the attacker can issue requests to any internal HTTP service that the router can reach. The combination of authentication requirement and DNS rebinding makes exploitation non‑trivial, but the potential impact on confidentiality, integrity, and availability of internal services is significant.