GHSA-fhh6-4qxv-rpqj: 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

Summary

9router exposes unauthenticated endpoints under /api/cli-tools/* and /api/mcp/*, which fall outside the authentication matcher in src/proxy.js. An attacker can POST a custom plugin with an arbitrary command and args to /api/cli-tools/cowork-settings, then GET /api/mcp/[plugin]/sse to trigger spawn() with that command, executing arbitrary OS commands as the user running 9router with no credentials required.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol

Related items

• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer
• InfoAnthropic Warns Small AI Models Could Soon Form Self-Propagating IoT BotnetsSimilar attack · The Hacker News
• InfoAgent Baseline Publishes Security Reference Architecture for Software FactoriesSimilar attack · Socket Blog