CVE-2026-108593 in 9router
Summary
by MITRE • 10/10/2026
9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in 9router versions 0.4.1 through 0.5.99 represents a critical configuration injection flaw within the application's administrative interface. Specifically, this weakness resides in the POST /api/cli-tools/hermes-settings endpoint, which is designed to update settings for the Hermes Agent component. The core technical failure stems from insufficient input validation and sanitization of user-supplied data before it is written to the system configuration file, typically named config.yaml. Because the application processes these inputs without adequately escaping special characters or restricting allowed key-value pairs, an attacker who has obtained valid authentication credentials can manipulate the structure of the configuration file itself rather than just modifying a single setting value. This lack of strict schema enforcement allows for the injection of arbitrary keys that are not part of the intended configuration parameters.
The operational impact of this vulnerability is severe due to the specific behavior of the Hermes Agent when processing its configuration. The agent is designed to execute certain automated hooks, including those triggered by large language model interactions. By injecting a specially crafted baseUrl parameter containing double quotes and newline characters, an authenticated attacker can break out of the intended string context and introduce new configuration entries such as hooks_auto_accept set to true and a custom hook for post_llm_call commands. The critical aspect of this exploit is that once these malicious keys are written to the config.yaml file, the Hermes Agent executes them without requiring further user approval or confirmation. This effectively grants the attacker persistent command execution capabilities within the context of the application's runtime environment every time an LLM call is processed by the agent.
From a threat modeling perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), as it allows for the injection of executable logic through configuration manipulation rather than direct code input. Furthermore, in terms of the MITRE ATT&CK framework, this exploit maps to T1505.003 Server Software Component: Web Shell and potentially T1059 Command and Scripting Interpreter if the injected commands invoke system shells or scripts. The ability to execute arbitrary shell commands via a post-LLM call hook provides an attacker with a reliable persistence mechanism that is triggered by normal application usage, making it difficult to detect through standard monitoring of explicit login events alone.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Users should immediately upgrade 9router to version 0.5.100 or later where this configuration injection flaw has been addressed with proper input validation. For systems that cannot be upgraded instantly, administrators should restrict access to the /api/cli-tools/hermes-settings endpoint using network-level controls such as firewalls or reverse proxy rules, ensuring only trusted internal IPs can reach it. Additionally, implementing strict allow-listing for configuration keys in the application code would prevent arbitrary key injection regardless of input sanitization quality. Regular auditing of configuration files and monitoring for unexpected changes to config.yaml can also help detect exploitation attempts early before full system compromise occurs.