GHSA-fhh6-4qxv-rpqj
Critical · 10.0CVSS
10.0
EPSS
—
Published
May 19, 2026
CISA due date
—
The record
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | 9router | 0.4.30 | 0.4.37 |
Related vulnerabilities
- CVE-2026-46339 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes Same vulnerability
- GHSA-xrrh-p7f2-27vm decolua 9router vulnerable to authorization bypass Also affects 9router
- CVE-2026-5842 A security vulnerability has been detected in decolua 9router up to 0.3.47. Also affects 9router
- CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306
- CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-306
- CVE-2026-89261 MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search… CWE-306
- CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an… CWE-306