--- title: "Security digest: October 9, 2025" url: https://erroneo.us/security/2025-10-09/ description: "October 9, 2025 vulnerability digest: 1 CISA KEV addition (Grafana Labs); 4 critical advisories (PyPI, npm). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2025-10-09 date_modified: 2025-10-09 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 9, 2025 1 known exploited (cisa kev) addition and 4 critical advisories. ## Take stock - Do you run any of these? Grafana Labs Grafana. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-10-30. - PyPI: 3 critical advisories ( scio-pypi , bbot ). Check with pip-audit (or: pip show ) . - npm: 1 critical advisory ( flowise , flowise-components , Flowise ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2021-43798](https://erroneo.us/security/cve/CVE-2021-43798/index.md) Grafana Labs Grafana: Grafana Path Traversal Vulnerability (CISA due 2025-10-30) ## Critical advisories - [GHSA-m9mp-6x32-5rhg](https://erroneo.us/security/ghsa/GHSA-m9mp-6x32-5rhg/index.md) scio is vunerable to Remote Command Execution through PyTorch — PyPI scio-pypi <= 1.0.0 → no fix - [CVE-2025-61913](https://erroneo.us/security/cve/CVE-2025-61913/index.md) Flowise is vulnerable to arbitrary file write through its WriteFileTool — npm flowise < 3.0.8 → 3.0.8; npm flowise-components < 3.0.8 → 3.0.8; npm Flowise <= 3.0.5 → 3.0.8 - [CVE-2025-10283](https://erroneo.us/security/cve/CVE-2025-10283/index.md) BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE — PyPI bbot < 2.7.0 → 2.7.0 - [CVE-2025-10284](https://erroneo.us/security/cve/CVE-2025-10284/index.md) BBOT's various issues in unarchive.py can cause arbitrary file write and RCE — PyPI bbot < 2.7.0 → 2.7.0 --- Source page: https://erroneo.us/security/2025-10-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt