Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M
CVE-2026-463399Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Critical 10.0
In plain English
A critical-severity OS command injection in 9router from decolua. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | 9router | 0.4.37 | GHSA-fhh6-4qxv-rpqj |
Affected products (as reported)
Weakness: CWE-78, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H