CVE-2026-108593: 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint
9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooksautoaccept and a hooks.postllmcall shell command, which Hermes Agent executes without approval after an LLM call.
Affected Software
Event History
Frequently Asked Questions
Who needs access for this issue to be exploitable?
An attacker must be an authenticated 9Router dashboard user who can submit requests to the POST /api/cli-tools/hermes-settings endpoint.
What must occur after configuration injection for command execution to happen?
The injected Hermes Agent configuration must add hooks_auto_accept and a hooks.post_llm_call shell command. Hermes Agent executes that command without approval after an LLM call.
Which versions should be treated as affected?
9router versions 0.4.1 through 0.5.99 are identified as affected.