https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:16:14.235161+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336121 EUVD-2026-336121 2026-10-06T11:16:14.289670+00:00 EUVD-2026-336121 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56676 fkie_cve-2026-56676 2026-10-06T11:16:14.289714+00:00

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.

 https://cve.radiocsirt.org/vuln/ghsa-cmhj-wh2f-9cgx GHSA-cmhj-wh2f-9cgx — 9router: Image prefetch DNS rebinding allows SSRF to internal services 2026-10-06T11:16:14.289766+00:00

Affected: npm: 9router

## Summary

9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allows the server-side image prefetch to reach internal-only HTTP services (SSRF).

## Details

- **Affected version / commit:** 9router `v0.4.80` @ `b282f05`. - **Reachable through** `/v1/chat/completions` with a **vision-capable model** and an `image_url` content part. A vision-capable model name is required so the image survives modality stripping and the server-side prefetch is armed. - The provider used in this reproduction is the bundled **mock provider** — **no real API key and no real provider call**. - **internal-admin** (the SSRF target) is **not exposed to the host network**; it is reachable only from inside the Docker network. - **rebind-dns** behaviour for `rebind.9r.test`: - first A response → `1.1.1.1` (public) to pass the public-host guard, - second A response → `172.29.0.10` (internal-admin) during the fetch. - **internal-admin** logs `GET /ssrf-marker` with `peer=172.29.0.30` (the `proxied-router` container), proving the server-side fetch landed on the internal service. - **mock-provider** receives `POST /api/chat` and the flow completes with `HTTP 200`. - **Root cause:** DNS TOCTOU — the IP is **not pinned** between the validation resolution (the pu…