PT-2026-57210 · 9Router · 9Router

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-56676

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2

Description An authenticated attacker with access to the LLM proxy can perform a Server-Side Request Forgery (SSRF) by exploiting a Time-of-Check to Time-of-Use (TOCTOU) gap during image URL validation. The software validates image URLs by resolving the host before fetching, but the server-side fetch performed in open-sse/translator/concerns/image.js executes a separate DNS resolution. By using a vision-capable model and a DNS name that first resolves to a public IP and subsequently rebinds to an internal address, an attacker can force the server to make requests to internal-only HTTP services.

Recommendations Update to version 0.5.2.

Fix

Time Of Check To Time Of Use

SSRF

Weakness Enumeration

CWE-367

CWE-918

Related Identifiers

CVE-2026-56676

Affected Products

9Router

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-56676 · Security Note
• https://github.com/decolua/9router/releases/tag/v0.5.2 · Note
• https://github.com/decolua/9router/security/advisories/GHSA-cmhj-wh2f-9cgx · Note
• https://github.com/decolua/9router/commit/c7d07448c58bec1200741de0b73305b860416b82 · Note
• https://twitter.com/UpwindMDR/status/2075624298912333919 · Twitter Post
• https://twitter.com/infoflowcloud/status/2075615076120187346 · Twitter Post
• https://twitter.com/CVEnew/status/2075613570092425512 · Twitter Post