---
title: "Security digest: February 4, 2026"
url: https://erroneo.us/security/2026-02-04/
description: "February 4, 2026 vulnerability digest: 15 critical advisories (npm, Go, PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-02-04
date_modified: 2026-02-04
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 4, 2026

15 critical advisories.

## Take stock

- npm: 12 critical advisories ( fuxa-server , n8n , survey-pdf ). Check with npm audit (or: npm ls <package>) .
- Go: 2 critical advisories ( github.com/rancher/local-path-provisioner , github.com/alist-org/alist/v3 ). Check with govulncheck ./... .
- PyPI: 1 critical advisory ( epyt-flow ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-25893](https://erroneo.us/security/cve/CVE-2026-25893/index.md) FUXA Unauthenticated Remote Code Execution via Admin JWT Minting — npm fuxa-server <= 1.2.9 → 1.2.10
- [CVE-2025-62878](https://erroneo.us/security/cve/CVE-2025-62878/index.md) Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern — Go github.com/rancher/local-path-provisioner < 0.0.34 → 0.0.34
- [CVE-2026-25056](https://erroneo.us/security/cve/CVE-2026-25056/index.md) n8n Merge Node has Arbitrary File Write leading to RCE — npm n8n < 1.118.0 → 1.118.0; npm n8n >= 2.0.0, < 2.4.0 → 2.4.0
- [CVE-2026-25630](https://erroneo.us/security/cve/CVE-2026-25630/index.md) survey-pdf Upgraded jsPDF Version Due to Security Vulnerability — npm survey-pdf <= 1.12.58 → 1.12.59; npm survey-pdf >= 2.0.0, <= 2.5.4 → 2.5.5
- [CVE-2026-25752](https://erroneo.us/security/cve/CVE-2026-25752/index.md) FUXA Unauthenticated Remote Arbitrary Device Tag Write — npm fuxa-server <= 1.2.9 → 1.2.10
- [CVE-2026-25052](https://erroneo.us/security/cve/CVE-2026-25052/index.md) n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users — npm n8n >= 2.0.0, < 2.5.0 → 2.5.0; npm n8n < 1.123.18 → 1.123.18
- [CVE-2026-25751](https://erroneo.us/security/cve/CVE-2026-25751/index.md) FUXA Unauthenticated Exposure of Plaintext Database Credentials — npm fuxa-server <= 1.2.9 → 1.2.10
- [CVE-2026-25053](https://erroneo.us/security/cve/CVE-2026-25053/index.md) n8n has OS Command Injection in Git Node — npm n8n >= 2.0.0, < 2.5.0 → 2.5.0; npm n8n < 1.123.10 → 1.123.10
- [CVE-2026-25160](https://erroneo.us/security/cve/CVE-2026-25160/index.md) Alist has Insecure TLS Config — Go github.com/alist-org/alist/v3 < 3.57.0 → 3.57.0
- [CVE-2026-25895](https://erroneo.us/security/cve/CVE-2026-25895/index.md) FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API — npm fuxa-server <= 1.2.9 → 1.2.10
- [CVE-2026-25115](https://erroneo.us/security/cve/CVE-2026-25115/index.md) n8n has a Python sandbox escape — npm n8n < 2.4.8 → 2.4.8
- [CVE-2026-21893](https://erroneo.us/security/cve/CVE-2026-21893/index.md) n8n Vulnerable to Command Injection in Community Package Installation — npm n8n >= 0.187.0, < 1.120.3 → 1.120.3
- [CVE-2026-25632](https://erroneo.us/security/cve/CVE-2026-25632/index.md) EPyT-Flow vulnerable to unsafe JSON deserialization (__type__) — PyPI epyt-flow < 0.16.1 → 0.16.1
- [CVE-2026-25049](https://erroneo.us/security/cve/CVE-2026-25049/index.md) n8n Has Expression Escape Vulnerability Leading to RCE — npm n8n < 1.123.17 → 1.123.17; npm n8n >= 2.0.0, < 2.5.2 → 2.5.2
- [CVE-2026-25894](https://erroneo.us/security/cve/CVE-2026-25894/index.md) FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration — npm fuxa-server <= 1.2.9 → 1.2.10

---
Source page: https://erroneo.us/security/2026-02-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt