CVE-2026-63313
9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.
- Affected products
- 9Router
- Fix
- Available
- CVSS 4.0
- 8.3 HIGH
- CVSS 3.1
- 7.7 HIGH
- EPSS
- 0.3% (26th percentile)
- Weakness
- CWE-918
- NVD status
- Deferred
- Published
- 2026-07-23
No indexed exploits for CVE-2026-63313 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-63313 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.