---
title: "Security digest: April 11, 2025"
url: https://erroneo.us/security/2025-04-11/
description: "April 11, 2025 vulnerability digest: 2 critical advisories (PyPI, crates.io (Rust)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-04-11
date_modified: 2025-04-11
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 11, 2025

2 critical advisories.

## Take stock

- PyPI: 1 critical advisory ( jupyter-remote-desktop-proxy ). Check with pip-audit (or: pip show <package>) .
- crates.io (Rust): 1 critical advisory ( surrealdb ). Check with cargo audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2025-32428](https://erroneo.us/security/cve/CVE-2025-32428/index.md) TigerVNC accessible via the network and not just via a UNIX socket as intended — PyPI jupyter-remote-desktop-proxy = 3.0.0 → 3.0.1
- [CVE-2025-71392](https://erroneo.us/security/cve/CVE-2025-71392/index.md) SurrealDB server-takeover via SurrealQL injection on backup import — crates.io (Rust) surrealdb >= 2.2.0, < 2.2.2 → 2.2.2; crates.io (Rust) surrealdb >= 2.1.0, < 2.1.5 → 2.1.5; crates.io (Rust) surrealdb < 2.0.5 → 2.0.5

---
Source page: https://erroneo.us/security/2025-04-11/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt