Vulnpedia
← All CVEs

CVE-2026-59800

CRITICAL 9.2 ALL-YEARS

Published 2026-07-07 · Last modified 2026-07-07 · VulnCheck · NVD: Deferred

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).

REPORTED EXPLOITATION

VulnCheck KEV reports exploitation for this CVE. These are source-specific reports; review the details and vendor guidance below.

Exploitation likelihood

2.0%chance of exploitation in 30 days · 81st percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation poc, automatable no

Impact if exploited

9.2CVSS 4.0 · CRITICAL · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Decolua

Products 9router

Weakness (CWE)

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • 9router npm

    pkg:npm/9router

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.4.44
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-g6g7-pvmx-m74p/GHSA-g6g7-pvmx-m74p.json"
  }
}
    GitHub Advisory Database · GHSA-g6g7-pvmx-m74p · Updated 2026-07-07T18:56:35.611377Z

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

All CVSS metrics

  • CRITICAL 9.2 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CRITICAL 9.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.2 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • CRITICAL 9.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS