CVE-2026-108593Published
9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108593 · Microsoft / collected KEV context
cve-program · CVE-2026-108593
- https://hackmd.io/@haind/9router-hermes-config-injection
- https://github.com/decolua/9router/blob/a99cf57239ff778b61e434c2786009d5ed1c412c/src/app/api/cli-tools/hermes-settings/route.js#L20-L35
- https://github.com/decolua/9router/blob/a99cf57239ff778b61e434c2786009d5ed1c412c/src/app/api/cli-tools/hermes-settings/route.js#L185-L223
- https://github.com/decolua/9router
- https://www.vulncheck.com/advisories/9router-0.4.1-through-0.5.99-config-injection-rce-via-hermes-settings-endpoint
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.