CVE Feed

    Dashboard / CVE / CVE-2026-108593

    CVE-2026-108593

    9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.

    Published:Oct 10, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 10, 2026
    EPSS Score:0.00268
    CVSS Score:6.4

    Affected Products

    Vendor
    Decolua
    Product
    9router

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-103530 (CVSS 6.9) — A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of th…
    CVE-2026-56682 (CVSS 5.3) — 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.j…
    CVE-2026-56681 (CVSS 7.3) — 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.j…
    CVE-2026-72860 (CVSS 6.3) — The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side …
    CVE-2026-56677 (CVSS 8.6) — 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/…
    CVE-2026-63732 (CVSS 9.4) — 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) th…
    CVE-2026-63313 (CVSS 8.3) — 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoin…
    CVE-2026-62312 (CVSS 8.8) — 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achie…
    CVE-2026-56678 (CVSS 6.4) — 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/ki…
    CVE-2026-56679 (CVSS 8.7) — 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire requ…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High