CVE-2026-46339

GitHubCurated repository PoCExploitCexploitintel/eip-pocs-and-cves

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python exploit script (poc/poc.py) that performs unauthenticated remote code execution against 9Router versions 0.4.30 to 0.4.36 by registering a malicious MCP plugin and triggering its command via SSE. It also includes a control harness (poc/control_test.py) that checks exploitability without executing a payload, and a writeup (README.md) describing the vulnerability chain.

Backdoor review

No backdoor observed in reviewed code

The supplied text evidence describes a legitimate PoC for CVE-2026-46339. The Python scripts (poc.py, control_test.py) perform only the documented exploit steps against a target specified by the user, using a harmless echo command in the control harness and a standard id command in the main PoC. No concealed executable behavior, persistence, credential theft, or unrelated payload is present in the reviewed text.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonMarkdown
Target software9router
Attack typesOS Command InjectionMissing Authentication
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file poc/poc.py is a complete exploit that exercises the vulnerability by registering a malicious plugin and executing an arbitrary OS command on the target, as described in its docstring and implemented in the exploit() function. The control_test.py file is a scanner that checks for exploitability without executing a payload, but the primary artifact includes an exploit script, making the overall classification 'exploit'.

poc/poc.py:1-153poc/control_test.py:1-80

Requirements

  • Target must be running a vulnerable version of 9router (>= 0.4.30, < 0.4.37) with the unprotected /api/cli-tools/* and /api/mcp/* routes exposed.README.md:22-24
  • Network access to the target's HTTP port.poc/poc.py:37

Observed behavior

  • Sends an unauthenticated POST request to /api/cli-tools/cowork-settings with a JSON payload containing a customPlugins array that includes an attacker-controlled command and arguments.poc/poc.py:55-74
  • Opens an SSE connection to /api/mcp/{plugin_name}/sse, which causes the server to spawn the registered command and stream its stdout back to the attacker.poc/poc.py:77-103
  • Checks the SSE stream for a unique marker and the output of the 'id' command to confirm successful remote code execution.poc/poc.py:128-134
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
/bin/sh -c 'echo <marker>; id'The main PoC (poc.py) executes a command on the target to demonstrate RCE, which is the stated purpose of the exploit.poc/poc.py:52
Command Execution
/bin/echo eip-controlThe control harness (control_test.py) uses a harmless echo command to test exploitability without executing a payload, as documented.poc/control_test.py:48
Network Connection
http://{host}:{port}/api/cli-tools/cowork-settingsThe PoC sends a POST request to the vulnerable endpoint to register a malicious plugin, which is the first step of the documented attack chain.poc/poc.py:68
Review boundaries

What the analysis did not establish

  • Two binary archive files (assets/9router-0.4.36.tgz and assets/9router-0.4.37.tgz) are present but were not analyzed; their contents could contain additional exploit or scanner code not visible in the text files.
  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files in the artifact were inspected, though all selected text files are complete.
  • Two binary archive files (9router-0.4.36.tgz, 9router-0.4.37.tgz) are present in the artifact but were not analyzed; their contents could theoretically contain unrelated malicious code, though the text evidence gives no reason to suspect this.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

CVE-2026-46339/docker-compose.yml

Created Vuln labCVE-2026-46339Compose · mixed

1 Compose manifest · 2 Dockerfiles · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs two containers: a vulnerable 9router 0.4.36 instance and a patched 9router 0.4.37 instance, both exposing port 20128 on configurable host ports. The environment is designed to demonstrate CVE-2026-46339, an unauthenticated RCE vulnerability.

CVE-2026-46339/docker-compose.yml:1-16CVE-2026-46339/README.md:1-98

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a self-contained lab for CVE-2026-46339, with a vulnerable build, a patched control, and a PoC exploit. The Dockerfiles build specific vulnerable and patched versions of the 9router npm package, and the PoC scripts target the vulnerable service to demonstrate RCE.

CVE-2026-46339/README.md:1-98CVE-2026-46339/Dockerfile.vulnerable:1-23CVE-2026-46339/Dockerfile.patched:1-22
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable

vulnerable target

A Docker service built from Dockerfile.vulnerable, running 9router 0.4.36 on node:22-alpine. It exposes port 20128, mapped to host port 24678 by default. The service is the intended target for the PoC exploit.

CVE-2026-46339/docker-compose.yml:2-8CVE-2026-46339/Dockerfile.vulnerable:1-23

patched

patched control

A Docker service built from Dockerfile.patched, running 9router 0.4.37 on node:22-alpine. It exposes port 20128, mapped to host port 24679 by default. The service serves as a control to verify the fix prevents exploitation.

CVE-2026-46339/docker-compose.yml:10-16CVE-2026-46339/Dockerfile.patched:1-22

poc.py

exploit script

A Python 3 script that performs the two-step RCE exploit against a target host and port. It registers a malicious custom plugin via POST /api/cli-tools/cowork-settings, then opens an SSE stream via GET /api/mcp/{name}/sse to trigger command execution and capture output.

CVE-2026-46339/poc/poc.py:1-153

control_test.py

control harness

A Python 3 script that tests whether the unauthenticated surface is exploitable by attempting to register a harmless plugin. It reports EXPLOITABLE or NOT-EXPLOITABLE without executing a payload.

CVE-2026-46339/poc/control_test.py:1-80
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-46339

Supported by supplied evidence

The README, Dockerfiles, and PoC scripts all explicitly reference CVE-2026-46339. The vulnerable Dockerfile builds the affected version 0.4.36, the patched Dockerfile builds the fixed version 0.4.37, and the PoC demonstrates the described unauthenticated RCE chain. The verification report confirms successful reproduction.

CVE-2026-46339/README.md:1-98CVE-2026-46339/Dockerfile.vulnerable:1-23CVE-2026-46339/Dockerfile.patched:1-22CVE-2026-46339/poc/poc.py:1-153CVE-2026-46339/poc_verification_report.md:1-44
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the containers.CVE-2026-46339/README.md:68-72
  • Python 3 is required to run the PoC scripts.CVE-2026-46339/README.md:68-72
  • The vulnerable service must be accessible on the specified host and port (default 127.0.0.1:24678).CVE-2026-46339/poc/poc.py:120-123

Evidence-described exercise path

  1. Build and start the containers using 'docker compose up -d --build'.CVE-2026-46339/README.md:68-69
  2. Run the PoC exploit against the vulnerable service: 'python3 poc/poc.py 127.0.0.1 24678'.CVE-2026-46339/README.md:70
  3. Observe the output: the PoC should print a unique marker and the 'id' command output, confirming RCE.CVE-2026-46339/README.md:74-77
  4. Run the control harness against the patched service: 'python3 poc/control_test.py 127.0.0.1 24679'.CVE-2026-46339/README.md:71
  5. Verify the control harness reports NOT-EXPLOITABLE (HTTP 401).CVE-2026-46339/README.md:77
  6. Stop and remove the containers: 'docker compose down'.CVE-2026-46339/README.md:72
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own vulnerable container. The PoC executes a command inside the vulnerable container to demonstrate RCE, which is expected for a vulnerability lab. The control harness uses a harmless echo command. No evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended lab target.

CVE-2026-46339/poc/poc.py:1-153CVE-2026-46339/poc/control_test.py:1-80CVE-2026-46339/docker-compose.yml:1-16
Review boundaries

What the analysis did not establish

  • The two .tgz asset files (9router-0.4.36.tgz and 9router-0.4.37.tgz) are uninspected binaries; their internal contents are not analyzed.
  • The packet omits several referenced files (intel_brief.md, lab_build_report.md, vulnerability_analysis.md) that are listed in the file inventory but not included as evidence.
  • The Docker Compose file uses variable substitution for ports, but no .env file is provided; the default values are assumed from the Compose file.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Linked vulnerabilities

1