CVE-2026-59800: 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-i

9Router versions before 0.4.44 have a critical vulnerability where an unauthenticated attacker can execute arbitrary OS commands through the /api/tunnel/tailscale-install endpoint. The vulnerability exists because the sudoPassword field from user input is passed directly to a shell command without proper validation, and the endpoint lacks authorization checks (middleware matcher protection). An attacker can exploit this when sudo doesn't prompt for a password, such as when the process runs as root or NOPASSWD is configured.