CVE-2026-108593: 9router Configuration Injection RCE Flaw

CVE-2026-108593 Overview

CVE-2026-108593 is a configuration injection vulnerability affecting 9router versions 0.4.1 through 0.5.99. The flaw resides in the POST /api/cli-tools/hermes-settings endpoint, which fails to sanitize user-controlled input before writing it to the Hermes Agent config.yaml file. Authenticated dashboard users can submit a baseUrl value containing double quotes and newline characters to inject arbitrary YAML keys. By adding hooks_auto_accept and a hooks.post_llm_call shell command, attackers achieve command execution through the Hermes Agent after an LLM call completes. The weakness is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated attackers can achieve remote code execution on hosts running the Hermes Agent by injecting shell hooks that execute automatically without user approval.

Affected Products

9router version 0.4.1 (lower bound)
9router versions 0.4.2 through 0.5.98
9router version 0.5.99 (upper bound)

Discovery Timeline

2026-10-10 - CVE-2026-108593 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108593

Vulnerability Analysis

The 9router dashboard exposes an API endpoint that persists Hermes Agent settings to disk as YAML. The handler at src/app/api/cli-tools/hermes-settings/route.js accepts a baseUrl string from authenticated users and concatenates it into the serialized config.yaml without escaping YAML control characters.

Because the value is wrapped in double quotes during serialization, an attacker who supplies a baseUrl containing " characters and embedded newlines can close the string context and append additional YAML keys. The injected keys include hooks_auto_accept: true and a hooks.post_llm_call entry pointing to an arbitrary shell command. Once Hermes Agent reloads the configuration, every LLM call triggers the attacker-supplied command without prompting for approval, converting a configuration write into reliable command execution.

Root Cause

The underlying defect is improper neutralization of special elements in input used to build a YAML configuration file. The endpoint treats baseUrl as a trusted scalar and performs string concatenation instead of structured YAML serialization. See the vulnerable handler region in the 9router route.js source.

Attack Vector

Exploitation requires an authenticated dashboard session with permission to update Hermes settings. The attacker issues a POST request to /api/cli-tools/hermes-settings containing a crafted baseUrl field. The payload closes the quoted YAML value, inserts a newline, and appends hooks_auto_accept plus a hooks.post_llm_call command. The Hermes Agent executes the shell command on its next LLM invocation. Additional technical analysis is documented in the HackMD 9router Hermes Config Injection writeup and the VulnCheck Advisory for 9router.

No verified proof-of-concept code is published in the referenced sources beyond the prose description above.

Detection Methods for CVE-2026-108593

Indicators of Compromise

Unexpected hooks_auto_accept, hooks.post_llm_call, or hooks.pre_llm_call keys present in Hermes Agent config.yaml.
baseUrl values in config.yaml containing embedded newline characters, backslash escapes, or stray double quotes.
Child processes spawned by the Hermes Agent that execute shells (/bin/sh, bash, cmd.exe) or scripting interpreters shortly after an LLM request completes.

Detection Strategies

Audit POST /api/cli-tools/hermes-settings requests for baseUrl payloads containing ", \n, or YAML control tokens such as hooks.
Monitor file integrity on the Hermes Agent config.yaml and alert on writes that introduce new top-level keys outside an approved allowlist.
Correlate Hermes Agent LLM activity with process-creation telemetry to surface anomalous command execution following model calls.

Monitoring Recommendations

Centralize 9router dashboard access logs and alert on configuration-change endpoints invoked by non-administrative accounts.
Baseline the set of YAML keys written to config.yaml and flag drift from that baseline.
Track Hermes Agent process ancestry and alert on executions of interpreters or networking tools that have no legitimate operational purpose.

How to Mitigate CVE-2026-108593

Immediate Actions Required

Upgrade 9router to a release above 0.5.99 that remediates the Hermes settings handler.
Restrict dashboard accounts authorized to call /api/cli-tools/hermes-settings to a minimum set of trusted administrators.
Inspect existing Hermes config.yaml files for injected hooks_auto_accept or hooks.post_llm_call entries and remove unauthorized values.
Rotate credentials and API tokens accessible to the host if post-LLM hooks executed arbitrary commands.

Patch Information

Refer to the 9router GitHub repository for the fixed release and commit history. The VulnCheck Advisory for 9router tracks the affected version range (0.4.1 through 0.5.99) and should be consulted for upgrade guidance.

Workarounds

Disable the Hermes settings endpoint at the reverse proxy or application gateway until the patched version is deployed.
Enforce strict allowlist validation on the baseUrl field, rejecting any value containing quotes, newlines, or non-URL characters.
Run the Hermes Agent under a least-privilege service account to limit the blast radius of hook-triggered commands.
Set hooks_auto_accept to false through configuration management and alert if it is modified at runtime.

bash

# Configuration example: block suspicious baseUrl writes at a reverse proxy (nginx)
location /api/cli-tools/hermes-settings {
    if ($request_method = POST) {
        if ($request_body ~* "(\\n|\"|hooks_auto_accept|post_llm_call)") {
            return 403;
        }
    }
    proxy_pass http://9router_upstream;
}