A remote, low-privileged attacker can chain a hardcoded default password, a network-gate bypass, and unvalidated process spawning in 9router 0.4.59 to execute arbitrary code on the host.
What Is It
CVE-2026-63732 is a critical (CVSS 3.1 base score 9.9) vulnerability chain in the 9router npm package (vendor: decolua), classified as CWE-78. It combines three flaws: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins.
Why It Matters
Chained together, these flaws let a remote attacker with low privileges log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin (e.g. node -e <payload>) to achieve arbitrary code execution on the host operating system when the plugin's SSE endpoint is triggered. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network reachability, low attack complexity, and low required privileges, the latter satisfied by the default credential, with full high impact to confidentiality, integrity, and availability and a changed scope reaching the underlying host. A secondary CVSS 4.0 metric rates it 9.4 (CRITICAL).
What's Vulnerable
The 9router package (npm: 9router) at versions prior to 0.4.60 is affected; the disclosure specifically cites 0.4.59. Version 0.4.60 and later are unaffected.
Patch Status
The issue is fixed in 9router 0.4.60. Users should upgrade to 0.4.60 or later, which removes the vulnerable behavior. The default status for versions at or above 0.4.60 is unaffected.
Note: No CISA KEV entry was supplied for this CVE, so active exploitation is not confirmed by KEV at this time.