PT-2026-64185 · Decolua · 9Router

Sondt99 · CVE-2026-63313 · Publicado 2026-07-23 · Atualizado 2026-07-23

Mitre

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-63313

Produtos afetados

9Router

Referências · 3

• https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825 · Aviso do Fabricante
• https://vulncheck.com/advisories/9router-before-server-side-request-forgery-via-v1-web-fetch · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63313 · Nota de Segurança