Search: CVE-2026-46339

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	10.0	EPSS 2.8%	CVE-2026-46339decolua 9router · OS Command Injection Critical10.0EPSS 2.8%2026-07-15CVE Database V5CVE-2026-46339 9Router versions from 0.4.30 up to but not including 0.4.37 contain an OS command injection vulnerability in the src/proxy.js middleware. This flaw allows unauthenticated attackers to register custom plugins and execute commands via the MCP bridge due to insufficient protection of certain API endpoints. The vulnerability is fixed starting with version 0.4.37. EPSS 2.8%Vulnerability CWE-78	CVE Database V5	2026-07-15

Page 1 of 1