https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:48:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336121 EUVD-2026-336121 https://cve.radiocsirt.org/vuln/euvd-2026-336121 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56676 <p>9Router is an AI router &amp; token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.</p> <p>9Router is an AI router &amp; token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56676 https://cve.radiocsirt.org/vuln/ghsa-cmhj-wh2f-9cgx <p><strong>Affected:</strong> npm: 9router</p> <p>## Summary</p> <p>9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allows the server-side image prefetch to reach internal-only HTTP services (SSRF).</p> <p>## Details</p> <p>- **Affected version / commit:** 9router `v0.4.80` @ `b282f05`. - **Reachable through** `/v1/chat/completions` with a **vision-capable model** and an `image_url` content part. A vision-capable model name is required so the image survives modality stripping and the server-side prefetch is armed. - The provider used in this reproduction is the bundled **mock provider** — **no real API key and no real provider call**. - **internal-admin** (the SSRF target) is **not exposed to the host network**; it is reachable only from inside the Docker network. - **rebind-dns** behaviour for `rebind.9r.test`: - first A response → `1.1.1.1` (public) to pass the public-host guard, - second A response → `172.29.0.10` (internal-admin) during the fetch. - **internal-admin** logs `GET /ssrf-marker` with `peer=172.29.0.30` (the `proxied-router` container), proving the server-side fetch landed on the internal service. - **mock-provider** receives `POST /api/chat` and the flow completes with `HTTP 200`. - **Root cause:** DNS TOCTOU — the IP is **not pinned** between the validation resolution (the pu…</p> <p><strong>Affected:</strong> npm: 9router</p> <p>## Summary</p> <p>9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allows the server-side image prefetch to reach internal-only HTTP services (SSRF).</p> <p>## Details</p> <p>- **Affected version / commit:** 9router `v0.4.80` @ `b282f05`. - **Reachable through** `/v1/chat/completions` with a **vision-capable model** and an `image_url` content part. A vision-capable model name is required so the image survives modality stripping and the server-side prefetch is armed. - The provider used in this reproduction is the bundled **mock provider** — **no real API key and no real provider call**. - **internal-admin** (the SSRF target) is **not exposed to the host network**; it is reachable only from inside the Docker network. - **rebind-dns** behaviour for `rebind.9r.test`: - first A response → `1.1.1.1` (public) to pass the public-host guard, - second A response → `172.29.0.10` (internal-admin) during the fetch. - **internal-admin** logs `GET /ssrf-marker` with `peer=172.29.0.30` (the `proxied-router` container), proving the server-side fetch landed on the internal service. - **mock-provider** receives `POST /api/chat` and the flow completes with `HTTP 200`. - **Root cause:** DNS TOCTOU — the IP is **not pinned** between the validation resolution (the pu…</p> https://cve.radiocsirt.org/vuln/ghsa-cmhj-wh2f-9cgx