simoesctt/ctt-enhanced-cve-2026-46339-exploit-enginePython framework exploiting CVE-2026-46339 for unauthenticated RCE on 9Router via MCP bridge, using temporal sharding and dispersion to evade detection.
A specialized Python framework that executes unauthenticated remote code execution via the 9Router Model Context Protocol (MCP) bridge by deploying a 33-layer temporal phase cascade, Riemann-Hadamard dispersion, and an 11 ns wedge filter to bypass traditional proxy and process-monitoring defenses.
Full Details of the CTT-Enhanced Exploit The Core Vulnerability Mechanics (CVE-2026-46339): 9Router versions up to 0.4.36 leave /api/cli-tools/* and /api/mcp/* unprotected by the src/proxy.js authentication middleware. This permits unauthenticated attackers to POST custom plugin arrays to src/app/api/cli-tools/cowork-settings/route.js, storing attacker-controlled binaries and arguments into the global process state (globalThis.__9routerCustomPlugins). Triggering the SSE route via /api/mcp/[plugin]/sse/route.js subsequently forces spawn() to execute the injected definitions. The CTT Physics Layer Transformation: Instead of sending a single blunt command that immediately triggers EDR signatures, process creation auditing, or basic web-application firewall (WAF) string filters, the payload is split into 33 discrete temporal shards. Riemann-Hadamard Dispersion & Decay: Each shard is scaled using an exponential priority decay calculation (E(d) = E_0 e^{-\alpha d} where \alpha = 0.0302011) mapped against the first 24 Riemann zeros. This disguises the signature pattern across network boundaries. Wedge Filter Synchronization (\tau_w = 11\text{ ns}): The final execution phase aligns with the base temporal resonance frequency (\Omega_t = 587000), bypassing standard inspection layers by mimicking authorized inter-process messaging pulses.
