CVE-2026-56676

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.

• CWE-367
• CWE-918

• https://github.com/decolua/9router/commit/c7d07448c58bec1200741de0b73305b860416b82
• https://github.com/decolua/9router/releases/tag/v0.5.2
• https://github.com/decolua/9router/security/advisories/GHSA-cmhj-wh2f-9cgx
• https://github.com/decolua/9router/security/advisories/GHSA-cmhj-wh2f-9cgx

Published

Jul 10, 2026

Last Modified

Jul 13, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5667Use of Hard-coded Credentials vulnerability in Mitsubishi El…7.2
• CVE-2026-56670ComfyUI is a modular diffusion model GUI, api and backend wi…8.2
• CVE-2026-56671ComfyUI is a modular diffusion model GUI, api and backend wi…7.5
• CVE-2026-56672ComfyUI is a node-based diffusion model GUI, API, and backen…8.2
• CVE-2026-56673ComfyUI is a modular diffusion model GUI, API, and backend w…7.5
• CVE-2026-566759Router is an AI router & token saver. Prior to 0.5.2, 9rout…8.3
• CVE-2026-566789Router is an AI router & token saver. Prior to 0.5.6, the K…6.4
• CVE-2026-566799Router is an AI router & token saver. Prior to 0.5.4, the P…8.7
• CVE-2026-5668A flaw has been found in Cyber-III Student-Management-System…2.4
• CVE-2026-56687Dell ThinOS 10, versions prior to 2605_10.2100, contain an O…7.8
• CVE-2026-56688Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s)…9.1
• CVE-2026-56689Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s)…7.7