CVE-2026-103530

HighCVSS 7.3

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the fetch function in src/shared/utils/ssrfGuard.js of the Search Endpoint component. Manipulation of the provider_options.baseUrl argument results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action.

Risk Assessment

The SSRF vulnerability may allow an attacker to send requests to internal resources, risking information disclosure or access to services not exposed externally.

Recommendation

Immediately apply the available patch for decolua 9Router and verify and restrict the ability for users to set the provider_options.baseUrl parameter.

Other vulnerabilities in decolua 9Router

CVE-2026-10269Medium
A security vulnerability has been detected in decolua 9router up to version 0.4.0. The function isAuthenticated in src/dashboardGuard.js has improper authorization due to manipulation of the Host argument. The attack can be carried out remotely.

Original NVD description (English source)

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provider_options.baseUrl results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action to fix this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS