Description
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provider_options.baseUrl results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| decolua | 9Router | 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.9, 0.5.10, 0.5.11, 0.5.12, 0.5.13, 0.5.14, 0.5.15, 0.5.16, 0.5.17, 0.5.18, 0.5.19, 0.5.20, 0.5.21, 0.5.22, 0.5.23, 0.5.24, 0.5.25, 0.5.26, 0.5.27, 0.5.28, 0.5.29, 0.5.30, 0.5.31, 0.5.32, 0.5.33, 0.5.34, 0.5.35, 0.5.36, 0.5.37, 0.5.3… | — |
References
- VDB-412342 | decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery vdb-entry technical-description
- VDB-412342 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-103530 | CVE Analysis and Report third-party-advisory
- Submit #956865 | decolua 9router 0.5.55 Server-Side Request Forgery third-party-advisory
- https://github.com/decolua/9router/issues/3714 issue-tracking
- https://github.com/decolua/9router/pull/3723 issue-tracking patch
- https://github.com/decolua/9router/ product