CVE-2026-108593

{
  "etk_id": "ETK-2026-1205",
  "cve_id": "CVE-2026-108593",
  "display_id": "CVE-2026-108593",
  "ghsa_id": "GHSA-chcq-pfxc-99ww",
  "euvd_id": "EUVD-2026-96401",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated configuration injection in 9router",
  "summary": "9router versions 0.4.1 through 0.5.99 allow authenticated dashboard users to alter Hermes Agent configuration through the Hermes settings API. A user able to access that functionality may cause Hermes Agent to execute commands after an LLM interaction.",
  "mitigation": "Restrict dashboard and Hermes settings access to trusted administrators, and review Hermes Agent configuration for unexpected directives. Until an upstream fix is published, limit or disable use of the affected settings workflow where feasible.",
  "vendor": "decolua",
  "product": "9Router",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.4.1, <= 0.5.99"
      ],
      "ecosystem": "npm",
      "fixed_versions": [],
      "package_name": "9router",
      "purl": "pkg:npm/9router"
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0027,
  "epss_percentile": 0.1777,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.64134935,
  "t0_at": "2026-10-10T18:16:57.203000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-10T18:16:57.203000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T18:16:57.203000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108593"
    }
  }
}