9Router, an AI routing and token saving application, contains a CWE‑78 OS Command Injection flaw that lets an authenticated user trigger arbitrary code execution on the server. The vulnerability arises from a Host header bypass that grants access to localhost-only routes and the lack of validation of MCP plugin arguments delivered to child_process.spawn(). When the attacker crafts a request to the /api/mcp//sse endpoint with malicious plugin parameters, the server executes those parameters as shell commands, fully compromising the operating system.

The flaw affects all releases of 9Router by decolua before version 0.5.2. Any deployment running 0.5.1 or earlier is susceptible; version 0.5.2 and later contain the fix.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog. However, the attack requires valid authentication and the ability to target the specific /api/mcp//sse endpoint. If exploited, it results in complete compromise of the host operating system.