--- title: "Security digest: September 26, 2024" url: https://erroneo.us/security/2024-09-26/ description: "September 26, 2024 vulnerability digest: 1 brief (CUPS RCE); 1 critical advisory (npm). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-09-26 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 26, 2024 1 editorial brief and 1 critical advisory. ## Take stock - Check exposure: CUPS RCE . Linux and Unix desktops, laptops and print servers running cups-browsed with UDP 631 reachable from untrusted networks, and anyone whose hosts answer UDP 631 on the internet. - npm: 1 critical advisory ( agnai ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Check exposure** [CUPS cups-browsed RCE Chain: Real, but Needs a Print Job](https://erroneo.us/security/briefs/cups-browsed-rce-chain-cve-2024-47176/index.md): Not the internet-ending bug the pre-disclosure hype suggested: code runs only when someone prints to the rogue printer, as the unprivileged lp user; but nothing should expose UDP 631 to the internet, and exposed hosts can be abused for DDoS. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-47169](https://erroneo.us/security/cve/CVE-2024-47169/index.md) Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal — npm agnai < 1.0.330 → 1.0.330 --- Source page: https://erroneo.us/security/2024-09-26/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt