CVE-2026-103530

decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

State: Published
Severity: 6.9 Medium
Published: Sep 30, 2026
Updated: Oct 1, 2026
Reserved: Sep 30, 2026

Description

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provider_options.baseUrl results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-918 Server-Side Request Forgery

Affected Products

Product	Versions
9Routerdecolua	0.5.0Affected 0.5.1Affected 0.5.2Affected 0.5.3Affected 0.5.4Affected 0.5.5Affected 0.5.6Affected 0.5.7Affected 0.5.8Affected 0.5.9Affected 0.5.10Affected 0.5.11Affected 0.5.12Affected 0.5.13Affected 0.5.14Affected 0.5.15Affected 0.5.16Affected 0.5.17Affected 0.5.18Affected 0.5.19Affected 0.5.20Affected 0.5.21Affected 0.5.22Affected 0.5.23Affected 0.5.24Affected and 31 more versions

References

VDB-412342 | decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgeryvdb-entrytechnical-description
VDB-412342 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-103530 | CVE Analysis and Reportthird-party-advisory
Submit #956865 | decolua 9router 0.5.55 Server-Side Request Forgerythird-party-advisory
https://github.com/decolua/9router/issues/3714issue-tracking
https://github.com/decolua/9router/pull/3723issue-trackingpatch
https://github.com/decolua/9router/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.