Critical severity10.0GHSA Advisory· Published Jul 15, 2026· Updated Jul 16, 2026

CVE-2026-46339

Description

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
9routernpm	>= 0.4.30, < 0.4.37	0.4.37

Affected products

Decolua/9routerGHSA
Range: >= 0.4.30, < 0.4.37

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fhh6-4qxv-rpqjghsaADVISORY
github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqjnvdWEB
github.com/decolua/9router/commit/992f4db4a0d858bcc86b4786f2abab117a6ccdf8nvd

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000