CVE-2026-59800

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).

Unauthenticated RCE via /api/tunnel/tailscale-install

Affected: 9router (npm package) — current master (v0.4.39).

Summary

POST /api/tunnel/tailscale-install accepts a JSON body with a sudoPassword field and pipes it, followed by the body of https://tailscale.com/install.sh, into a child process spawned as sudo -S sh. The route is not present in the dashboard middleware matcher in src/proxy.js, so the request reaches the handler without invoking dashboardGuard.proxy(). In deployments where the Node process runs as root (Docker images derived from node:* without a USER directive, npm i -g 9router invoked as root, or systemd units without User=), the spawned sh runs as root and executes the attacker-supplied bytes.

Details

1. Middleware matcher (src/proxy.js:3-15)

export const config = {
  matcher: [
    "/",
    "/dashboard/:path*",
    "/api/shutdown",
    "/api/settings/:path*",
    "/api/keys",
    "/api/keys/:path*",
    "/api/providers/client",
    "/api/provider-nodes/validate",
    "/api/cli-tools/:path*",
    "/api/mcp/:path*",
  ],
};

Next.js invokes the middleware only for paths matching this list. Routes that are not listed — including the entire /api/tunnel/* family — do not invoke dashboardGuard.proxy(). No cookie, JWT, CLI token, or Host-header check is applied to them.

2. Route handler (src/app/api/tunnel/tailscale-install/route.js:18-67)

export async function POST(request) {
  const body = await request.json().catch(() => ({}));
  ...
  const sudoPassword =
    body.sudoPassword || getCachedPassword() || await loadEncryptedPassword() || "";
  ...
  const result = await installTailscale(sudoPassword, shortId, (msg) => {
    send("progress", { message: msg });
  });
  ...
}

body.sudoPassword comes from the request body and is passed to installTailscale, which dispatches to installTailscaleLinux on Linux.

3. Linux installation routine (src/lib/tunnel/tailscale.js:304-341)

async function installTailscaleLinux(sudoPassword, log) {
  log("Downloading install script...");
  return new Promise((resolve, reject) => {
    const curlChild = spawn("curl", ["-fsSL", "https://tailscale.com/install.sh"], { ... });
    let scriptContent = "";
    curlChild.stdout.on("data", (d) => { scriptContent += d.toString(); });
    curlChild.on("exit", (code) => {
      if (code !== 0) return reject(...);
      log("Running install script...");
      const child = spawn("sudo", ["-S", "sh"], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
      ...
      child.stdin.write(`${sudoPassword}\n`);   //  ← from request body
      child.stdin.write(scriptContent);
      child.stdin.end();
    });
  });
}

The byte stream sent to the stdin of the sudo -S sh child process is:

<sudoPassword from request body>\n
<https://tailscale.com/install.sh body>

When the caller is already root, has NOPASSWD configured for the user, or has a recent sudo timestamp cache, sudo -S sh does not read stdin for a password — it execs sh directly. The new sh process inherits the stdin pipe and reads it line by line:

1. The sudoPassword value from the request — interpreted as the first shell command.
2. The install.sh body — interpreted as subsequent shell input.

Appending ; exit 0 to the sudoPassword value causes sh to exit before the legitimate install.sh body runs. The host executes only the request-supplied bytes, as the 9router process user.

Both "Docker container running as root" and "npm i -g 9router on a host with NOPASSWD sudo" reach this path.

PoC

The reproduction below is self-contained: build a representative target image (Node process running as root, with sudo and curl on PATH), start it, send one unauthenticated POST with curl, and read the file written by the payload.

Step 1 — build the target image

docker build -t 9router-vuln-root - <<'EOF'
FROM…

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).

Unauthenticated RCE via /api/tunnel/tailscale-install

Affected: 9router (npm package) — current master (v0.4.39).

Summary

POST /api/tunnel/tailscale-install accepts a JSON body with a sudoPassword field and pipes it, followed by the body of https://tailscale.com/install.sh, into a child process spawned as sudo -S sh. The route is not present in the dashboard middleware matcher in src/proxy.js, so the request reaches the handler without invoking dashboardGuard.proxy(). In deployments where the Node process runs as root (Docker images derived from node:* without a USER directive, npm i -g 9router invoked as root, or systemd units without User=), the spawned sh runs as root and executes the attacker-supplied bytes.

Details

1. Middleware matcher (src/proxy.js:3-15)

export const config = {
  matcher: [
    "/",
    "/dashboard/:path*",
    "/api/shutdown",
    "/api/settings/:path*",
    "/api/keys",
    "/api/keys/:path*",
    "/api/providers/client",
    "/api/provider-nodes/validate",
    "/api/cli-tools/:path*",
    "/api/mcp/:path*",
  ],
};

Next.js invokes the middleware only for paths matching this list. Routes that are not listed — including the entire /api/tunnel/* family — do not invoke dashboardGuard.proxy(). No cookie, JWT, CLI token, or Host-header check is applied to them.

2. Route handler (src/app/api/tunnel/tailscale-install/route.js:18-67)

export async function POST(request) {
  const body = await request.json().catch(() => ({}));
  ...
  const sudoPassword =
    body.sudoPassword || getCachedPassword() || await loadEncryptedPassword() || "";
  ...
  const result = await installTailscale(sudoPassword, shortId, (msg) => {
    send("progress", { message: msg });
  });
  ...
}

body.sudoPassword comes from the request body and is passed to installTailscale, which dispatches to installTailscaleLinux on Linux.

3. Linux installation routine (src/lib/tunnel/tailscale.js:304-341)

async function installTailscaleLinux(sudoPassword, log) {
  log("Downloading install script...");
  return new Promise((resolve, reject) => {
    const curlChild = spawn("curl", ["-fsSL", "https://tailscale.com/install.sh"], { ... });
    let scriptContent = "";
    curlChild.stdout.on("data", (d) => { scriptContent += d.toString(); });
    curlChild.on("exit", (code) => {
      if (code !== 0) return reject(...);
      log("Running install script...");
      const child = spawn("sudo", ["-S", "sh"], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
      ...
      child.stdin.write(`${sudoPassword}\n`);   //  ← from request body
      child.stdin.write(scriptContent);
      child.stdin.end();
    });
  });
}

The byte stream sent to the stdin of the sudo -S sh child process is:

<sudoPassword from request body>\n
<https://tailscale.com/install.sh body>

When the caller is already root, has NOPASSWD configured for the user, or has a recent sudo timestamp cache, sudo -S sh does not read stdin for a password — it execs sh directly. The new sh process inherits the stdin pipe and reads it line by line:

1. The sudoPassword value from the request — interpreted as the first shell command.
2. The install.sh body — interpreted as subsequent shell input.

Appending ; exit 0 to the sudoPassword value causes sh to exit before the legitimate install.sh body runs. The host executes only the request-supplied bytes, as the 9router process user.

Both "Docker container running as root" and "npm i -g 9router on a host with NOPASSWD sudo" reach this path.

PoC

The reproduction below is self-contained: build a representative target image (Node process running as root, with sudo and curl on PATH), start it, send one unauthenticated POST with curl, and read the file written by the payload.

Step 1 — build the target image

docker build -t 9router-vuln-root - <<'EOF'
FROM…