---
title: "Security digest: June 4, 2024"
url: https://erroneo.us/security/2024-06-04/
description: "June 4, 2024 vulnerability digest: 4 critical advisories (npm, Go, crates.io (Rust)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-06-04
date_modified: 2024-06-04
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 4, 2024

4 critical advisories.

## Take stock

- npm: 2 critical advisories ( @janhq/core ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/projectdiscovery/interactsh ). Check with govulncheck ./... .
- crates.io (Rust): 1 critical advisory ( nano-id ). Check with cargo audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2024-36858](https://erroneo.us/security/cve/CVE-2024-36858/index.md) Jan path traversal vulnerability — npm @janhq/core <= 0.1.11 → no fix
- [CVE-2024-5262](https://erroneo.us/security/cve/CVE-2024-5262/index.md) Files or Directories Accessible to External Parties in ProjectDiscovery — Go github.com/projectdiscovery/interactsh < 1.2.0 → 1.2.0
- [CVE-2024-36400](https://erroneo.us/security/cve/CVE-2024-36400/index.md) Unable to generate the correct character set — crates.io (Rust) nano-id < 0.4.0 → 0.4.0
- [CVE-2024-37273](https://erroneo.us/security/cve/CVE-2024-37273/index.md) Jan path traversal vulnerability — npm @janhq/core <= 0.1.11 → no fix

---
Source page: https://erroneo.us/security/2024-06-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt