CVE-2026-62312: 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining

highCVSS 8.8CVE-2026-62312

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to child_process.spawn(), allowing malicious custom plugins to execute commands through /api/mcp//sse. This issue is fixed in version 0.5.2.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 8.8
Published: 2026-07-15
Last updated: 2026-07-16
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-62312

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-623120.72% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-62312	coverage & exploitation status	NVD · CVE.org

Recent advisories for 9Router is an

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalCVE-2026-63732: 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default pass…nvd · 2026-07-23
highCVE-2026-63313: 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/w…nvd · 2026-07-23
unknownCVE-2026-56679: 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes…nvd · 2026-07-15
mediumCVE-2026-56678: 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint PO…nvd · 2026-07-15
highCVE-2026-49353: 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js …nvd · 2026-07-15
criticalCVE-2026-49352: 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fa…nvd · 2026-07-15

CVE-2026-62312: 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining

Details

Exploitation outlook

Referenced CVEs

Recent advisories for 9Router is an

More from NVD Recent CVEs