CVE-2026-103530 PUBLISHED

decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

Assigner: VulDB
Reserved: 30.09.2026 Published: 30.09.2026 Updated: 01.10.2026

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provider_options.baseUrl results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action to fix this issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS Score: 6.9

Product Status

Vendor decolua
Product 9Router
Versions
  • Version 0.5.0 is affected
  • Version 0.5.1 is affected
  • Version 0.5.2 is affected
  • Version 0.5.3 is affected
  • Version 0.5.4 is affected
  • Version 0.5.5 is affected
  • Version 0.5.6 is affected
  • Version 0.5.7 is affected
  • Version 0.5.8 is affected
  • Version 0.5.9 is affected
  • Version 0.5.10 is affected
  • Version 0.5.11 is affected
  • Version 0.5.12 is affected
  • Version 0.5.13 is affected
  • Version 0.5.14 is affected
  • Version 0.5.15 is affected
  • Version 0.5.16 is affected
  • Version 0.5.17 is affected
  • Version 0.5.18 is affected
  • Version 0.5.19 is affected
  • Version 0.5.20 is affected
  • Version 0.5.21 is affected
  • Version 0.5.22 is affected
  • Version 0.5.23 is affected
  • Version 0.5.24 is affected
  • Version 0.5.25 is affected
  • Version 0.5.26 is affected
  • Version 0.5.27 is affected
  • Version 0.5.28 is affected
  • Version 0.5.29 is affected
  • Version 0.5.30 is affected
  • Version 0.5.31 is affected
  • Version 0.5.32 is affected
  • Version 0.5.33 is affected
  • Version 0.5.34 is affected
  • Version 0.5.35 is affected
  • Version 0.5.36 is affected
  • Version 0.5.37 is affected
  • Version 0.5.38 is affected
  • Version 0.5.39 is affected
  • Version 0.5.40 is affected
  • Version 0.5.41 is affected
  • Version 0.5.42 is affected
  • Version 0.5.43 is affected
  • Version 0.5.44 is affected
  • Version 0.5.45 is affected
  • Version 0.5.46 is affected
  • Version 0.5.47 is affected
  • Version 0.5.48 is affected
  • Version 0.5.49 is affected
  • Version 0.5.50 is affected
  • Version 0.5.51 is affected
  • Version 0.5.52 is affected
  • Version 0.5.53 is affected
  • Version 0.5.54 is affected
  • Version 0.5.55 is affected

Credits

  • CAPT (VulDB User) reporter

References

Problem Types

  • Server-Side Request Forgery CWE