CVE-2026-59800: 9router: Unauthenticated Root Access and Code Injection

Summary

An attacker can execute arbitrary code with root privileges on your system. This can happen if you're using the 9router package and it's running as root. To fix this, update to the latest version of 9router and ensure it's not running as root.

What to do

Update decolua 9router to version 0.4.44.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	decolua	9router	< 0.4.44
npm	decolua	9router	< 0.4.44 Fix: upgrade to 0.4.44

Original title

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matche...

Original description

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).

nvd CVSS3.1 9.8

nvd CVSS4.0 9.2

Vulnerability type

CWE-78 OS Command Injection

CWE-862 Missing Authorization