Is CVE-2026-59800 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59800 being exploited in the wild.

How severe is CVE-2026-59800?

Critical severity, with a CVSS score of 9.8, published 7 July 2026.

Which products and versions are affected?

9router (npm) SEMVER:introduced=0,fixed=0.4.44.

Is there a fix for CVE-2026-59800?

Yes. 9router (npm): upgrade to 0.4.44 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59800 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59800?

Check whether you run 9router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59800: decolua 9Router OS command injection in tailscale-install endpoint

CVE-2026-59800 · Severity: critical · CVSS 9.8 · Published 2026-07-07

9Router, a networking and routing tool, contains a critical security flaw in its Tailscale installation component. An unauthenticated attacker can remotely send a specially crafted request to the device to execute arbitrary system commands. This could lead to a complete takeover of the router, allowing attackers to intercept network traffic, access sensitive data, or use the device as a foothold for further attacks.

Technologies: 9router (npm). Vendors: npm.

Quick answers

Is CVE-2026-59800 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59800 being exploited in the wild.
How severe is CVE-2026-59800?: Critical severity, with a CVSS score of 9.8, published 7 July 2026.
Which products and versions are affected?: 9router (npm) SEMVER:introduced=0,fixed=0.4.44.
Is there a fix for CVE-2026-59800?: Yes. 9router (npm): upgrade to 0.4.44 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59800 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59800?: Check whether you run 9router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

9router (npm): upgrade to 0.4.44 or later
```
npm install 9router@0.4.44
```

Technical details

An OS command injection vulnerability exists in 9Router versions prior to 0.4.44 due to improper input validation and missing authorization. The 'POST /api/tunnel/tailscale-install' endpoint is excluded from the dashboard middleware's authorization checks, allowing unauthenticated access. The application takes the 'sudoPassword' field from the request body and pipes it directly into the stdin of a 'sudo -S sh' process. In environments where the process runs as root (such as default Docker configurations) or where NOPASSWD is configured, the shell interprets the 'sudoPassword' value as a command rather than a password. Attackers can exploit this to achieve Remote Code Execution (RCE) with the privileges of the 9Router process. A patch is available in version 0.4.44.

Affected products

decolua 9router < 0.4.44

Identifiers

CVE-2026-59800
GHSA-g6g7-pvmx-m74p

Timeline

2026-05-29: advisory: Vendor published GHSA advisory
2026-07-04: exploited: First exploitation evidence observed by Shadowserver Foundation
2026-07-07: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.