CVE-2026-108593Published
9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108593 · Microsoft / collected KEV context
cve-program · CVE-2026-108593
- https://hackmd.io/@haind/9router-hermes-config-injection
- https://github.com/decolua/9router/blob/a99cf57239ff778b61e434c2786009d5ed1c412c/src/app/api/cli-tools/hermes-settings/route.js#L20-L35
- https://github.com/decolua/9router/blob/a99cf57239ff778b61e434c2786009d5ed1c412c/src/app/api/cli-tools/hermes-settings/route.js#L185-L223
- https://github.com/decolua/9router
- https://www.vulncheck.com/advisories/9router-0.4.1-through-0.5.99-config-injection-rce-via-hermes-settings-endpoint
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.