CVE-2026-46339
CVE-2026-46339 · 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
CVSS 10.0 · Crítica · EPSS 2,8% · Código de explotación público · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node