Executive brief
9Router, an AI routing and token management tool, contains a critical security flaw that allows unauthorized individuals to take complete control of the server. By sending two specific requests to unprotected parts of the application, an attacker can execute arbitrary commands without needing a username or password. This could lead to the theft of sensitive AI provider API keys, full access to the server's files, and potential disruption of all AI-related operations.
Technical details
The vulnerability stems from a narrow allowlist in the Next.js middleware (src/proxy.js) which fails to protect the /api/cli-tools/* and /api/mcp/* routes. An unauthenticated attacker can chain two requests to achieve RCE: first, a POST request to /api/cli-tools/cowork-settings to register a 'customPlugin' with an arbitrary OS command and arguments; second, a GET request to /api/mcp/[plugin]/sse to trigger the 'spawn()' function in the MCP bridge (src/lib/mcp/stdioSseBridge.js). Because the application does not validate the command or arguments before execution, the attacker can gain a reverse shell or perform arbitrary file operations. The issue is fixed in version 0.4.37 by extending the middleware authentication matcher.
Affected products
- decolua 9router >= 0.4.30, < 0.4.37
Timeline
- 2026-05-13: patched: Fix released in version 0.4.37
- 2026-07-15: advisory: GHSA-fhh6-4qxv-rpqj published