9router npm Package Under Investigation for Critical Supply-Chain Vulnerabilities
The 9router npm package is under investigation for containing a chain of critical vulnerabilities that may allow remote, unauthenticated attackers to execute arbitrary code on the host operating system.
What happened
Reportedly, versions of 9router prior to 0.4.60 contain a hardcoded default password (123456), a bypassable LOCAL_ONLY network gate, and unvalidated arguments passed to child_process.spawn(). These issues collectively enable a remote attacker to log in using the default credentials, spoof the Host header to access local-only routes, and register a malicious plugin to achieve arbitrary code execution when the plugin's SSE endpoint is triggered.
Affected users are advised to upgrade to 9router@0.4.60 as a precaution. Additionally, rotating any default credentials in environments where 9router is deployed is recommended. The severity of this issue is rated as CRITICAL with a CVSS score of 9.9. Further details and confirmation should be obtained from the primary sources.
How 0Day mitigates this
9router is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.