Digest · Friday
Security digest: January 30, 2026
2 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 1 critical advisory (
cai-framework). Check withpip-audit (or: pip show <package>). - npm: 1 critical advisory (
@orval/core). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 1
Check: npm audit (or: npm ls <package>)
- Orval has Code Injection via unsanitized x-enum-descriptions using JS comments CVE-2026-25141 CVSS 9.3 Critical
@orval/core>= 7.19.0, < 7.21.0 → fixed in 7.21.0;@orval/core>= 8.0.0, < 8.2.0 → fixed in 8.2.0
PyPI 1
Check: pip-audit (or: pip show <package>)
- CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection CVE-2026-25130 CVSS 9.6 Critical
cai-framework<= 0.5.10 → no fix listed