CVE-2026-46339

Name of the Vulnerable Software and Affected Versions 9router versions 0.4.30 through 0.4.36

Description 9router contains a flaw where the Next.js middleware fails to protect several API endpoints, allowing unauthenticated network-adjacent attackers to execute arbitrary OS commands as the user running the process. The issue stems from a narrow allowlist in src/proxy.js that leaves the /api/cli-tools/* and /api/mcp/* endpoints unguarded. An attacker can first use the /api/cli-tools/cowork-settings endpoint to register a malicious plugin by providing a controlled command and args via the customPlugins variable. Subsequently, the attacker can trigger the execution of this command by calling the /api/mcp/{plugin}/sse endpoint, which invokes the spawn() function using the previously stored malicious parameters. This can lead to full server compromise, including the exfiltration of API keys, AWS credentials, and potential container escape to host root if the process has docker group membership.

Recommendations Update 9router to a version later than 0.4.36. Extend the middleware matcher in src/proxy.js to include /api/cli-tools/:path* and /api/mcp/:path* to enforce authentication. Implement a command allowlist within the registerCustomPlugin() function in src/lib/mcp/stdioSseBridge.js to validate the command variable. Sanitize the customPlugins input at the API boundary in src/app/api/cli-tools/cowork-settings/route.js by validating the command and sanitizing the name variable.