9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.

[ Fixes ]Fixes and patches

• 9router 0.5.4Fixed version · GitHub Advisories · npm package 9router: upgrade to 0.5.4 or later (affected <= 0.5.2)

[ Packages ]Affected open-source packages

• 9router npmAffected <= 0.5.2 · fixed in 0.5.4 · GHSA-vmjq-hvgq-2wv4

[ References ]References

• github.com/decolua/9router/security/advisories/GHSA-vmjq-hvgq-2wv4x_refsource_CONFIRM