# CVE-2026-62312: decolua 9Router OS command injection via Host header bypass

Source: https://junglewise.ai/threats/cve-2026-62312-decolua-9router-os-command-injection-via-host-header-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-62312 · Severity: high · CVSS 8.8 · Published 2026-07-15

9Router, an AI routing and token management tool, contains a security flaw that allows an authenticated user to take full control of the host server. By bypassing internal security checks and providing malicious plugin settings, an attacker can execute arbitrary commands on the operating system. This could lead to the theft of sensitive AI provider API keys, full database access, and the installation of persistent backdoors on the corporate network.

## Quick answers

**Is CVE-2026-62312 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62312 being exploited in the wild.

**How severe is CVE-2026-62312?** High severity, with a CVSS score of 8.8, published 15 July 2026.

**Which products and versions are affected?** decolua 9router < 0.5.2.

**Is there a fix for CVE-2026-62312?** A patch was published on 2026-06-17: Version 0.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62312 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-62312?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability chain in 9Router prior to version 0.5.2 allows for remote code execution (RCE). The first flaw is a Host header bypass where the 'isLocalRequest' check in 'src/dashboardGuard.js' incorrectly trusts the client-supplied Host header, allowing remote access to localhost-only routes. The second flaw is an OS command injection vulnerability where MCP plugin arguments are passed unvalidated to 'child_process.spawn()' in 'src/lib/mcp/stdioSseBridge.js'. An authenticated attacker can register a malicious plugin via '/api/cli-tools/cowork-settings' using a spoofed Host header and then trigger execution through the '/api/mcp/<plugin>/sse' endpoint. This allows execution of arbitrary shell commands with the privileges of the 9Router process.

## Affected products

- decolua 9router < 0.5.2

## Timeline

- 2026-06-17: patched: Version 0.5.2 released
- 2026-07-10: advisory: GitHub Security Advisory GHSA-63p9-g54h-prrp published
- 2026-07-15: disclosed: CVE-2026-62312 published to NVD

## References

- [https://github.com/decolua/9router/commit/da667836cc7584bea0edd893de1d590c9ea279dc](https://github.com/decolua/9router/commit/da667836cc7584bea0edd893de1d590c9ea279dc)
- [https://github.com/decolua/9router/releases/tag/v0.5.2](https://github.com/decolua/9router/releases/tag/v0.5.2)
- [https://github.com/decolua/9router/security/advisories/GHSA-63p9-g54h-prrp](https://github.com/decolua/9router/security/advisories/GHSA-63p9-g54h-prrp)