The 9router npm package (version <0.4.45) exposes an unauthenticated API endpoint /api/tunnel/tailscale-install that accepts a JSON body containing a sudoPassword field. This value is piped, along with the contents of https://tailscale.com/install.sh, into a child process spawned as 'sudo -S sh'. Because the route is not protected by the dashboardGuard middleware and no authentication checks are applied, an attacker can supply arbitrary shell commands in the sudoPassword field. When the Node.js process runs as root or sudo is configured to not require a password, the shell executes the attacker-supplied commands with root privileges. This leads to remote code execution on the host system. The vulnerability arises from missing authorization checks and unsafe command execution in the installation routine.

An unauthenticated attacker can execute arbitrary shell commands as root on the host running 9router if the Node.js process runs with root privileges or sudo is configured with NOPASSWD. This results in full system compromise, allowing attackers to read, modify, or delete any data, install malware, or pivot within the network. The vulnerability is critical due to the combination of unauthenticated access and root-level command execution.

A fix is available in 9router versions 0.4.45 and later. Users should upgrade to version 0.4.45 or newer to remediate this vulnerability. Until patched, avoid running the 9router Node.js process as root and ensure sudo requires a password (no NOPASSWD configuration). Additionally, restrict access to the /api/tunnel/tailscale-install endpoint or apply appropriate authentication and authorization controls to prevent unauthenticated access.