Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| 9router | npm | <= 0.4.71 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the /api/settings/database endpoint, which allows for unauthenticated export and import of the entire application database. The analysis of the provided security advisory and code snippets reveals four key functions involved in this vulnerability. The GET and POST functions in src/app/api/settings/database/route.js are the entry points for the attack. The GET handler calls exportDb from src/lib/db/index.js, which leaks sensitive information, including plaintext API keys, by selecting all data from the database. The POST handler calls importDb, also from src/lib/db/index.js, which allows an attacker to wipe and overwrite the entire database with arbitrary data. The root cause is the lack of proper authentication and authorization checks for these sensitive operations, relying only on a basic JWT or CLI token validation which any authenticated user possesses.
GETsrc/app/api/settings/database/route.js
POSTsrc/app/api/settings/database/route.js
importDbsrc/lib/db/index.js
exportDbsrc/lib/db/index.js