---
title: "Security digest: March 13, 2026"
url: https://erroneo.us/security/2026-03-13/
description: "March 13, 2026 vulnerability digest: 2 CISA KEV additions (Google); 10 critical advisories (npm, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-13
date_modified: 2026-03-13
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 13, 2026

2 known exploited (cisa kev) additions and 10 critical advisories.

## Take stock

- Do you run any of these? Google Chromium V8, Google Skia. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-27.
- npm: 7 critical advisories ( openclaw , locutus , @apollo/federation-internals , @apollo/gateway , @apollo/query-planner , oneuptime , @nyariv/sandboxjs ). Check with npm audit (or: npm ls <package>) .
- Go: 3 critical advisories ( github.com/dagu-org/dagu , github.com/centrifugal/centrifugo/v6 , github.com/centrifugal/centrifugo , github.com/centrifugal/centrifugo/v3 , github.com/centrifugal/centrifugo/v4 , github.com/centrifugal/centrifugo/v5 , github.com/emmansun/gmsm ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-3910](https://erroneo.us/security/cve/CVE-2026-3910/index.md) Google Chromium V8: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability (CISA due 2026-03-27)
- [CVE-2026-3909](https://erroneo.us/security/cve/CVE-2026-3909/index.md) Google Skia: Google Skia Out-of-Bounds Write Vulnerability (CISA due 2026-03-27)

## Critical advisories

- [CVE-2026-32916](https://erroneo.us/security/cve/CVE-2026-32916/index.md) OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes — npm openclaw >= 2026.3.7, < 2026.3.11 → 2026.3.11
- [CVE-2026-32304](https://erroneo.us/security/cve/CVE-2026-32304/index.md) Locutus vulnerable to RCE via unsanitized input in create_function() — npm locutus <= 3.0.13 → 3.0.14
- [CVE-2026-22172](https://erroneo.us/security/cve/CVE-2026-22172/index.md) OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes — npm openclaw <= 2026.3.11 → 2026.3.12
- [CVE-2026-32621](https://erroneo.us/security/cve/CVE-2026-32621/index.md) Apollo Federation vulnerable to prototype pollution via incomplete key sanitization — npm @apollo/federation-internals < 2.9.6 → 2.9.6; npm @apollo/federation-internals >= 2.10.0, < 2.10.5 → 2.10.5; npm @apollo/federation-internals >= 2.11.0, < 2.11.6 → 2.11.6
- [CVE-2026-32306](https://erroneo.us/security/cve/CVE-2026-32306/index.md) OneUptime ClickHouse SQL Injection via Aggregate Query Parameters — npm oneuptime < 10.0.23 → 10.0.23
- [CVE-2026-31886](https://erroneo.us/security/cve/CVE-2026-31886/index.md) Dagu: Path Traversal via `dagRunId` in Inline DAG Execution — Go github.com/dagu-org/dagu <= 2.2.4 → no fix
- [CVE-2026-32301](https://erroneo.us/security/cve/CVE-2026-32301/index.md) Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL — Go github.com/centrifugal/centrifugo/v6 <= 6.6.2 → 6.7.0; Go github.com/centrifugal/centrifugo <= 2.4.0 → no fix; Go github.com/centrifugal/centrifugo/v3 <= 3.2.3 → no fix
- [CVE-2026-26954](https://erroneo.us/security/cve/CVE-2026-26954/index.md) SandboxJS affected by a Sandbox Escape — npm @nyariv/sandboxjs <= 0.8.33 → 0.8.34
- [CVE-2026-32614](https://erroneo.us/security/cve/CVE-2026-32614/index.md) SM9 Infinity-Point Ciphertext Forgery Vulnerability — Go github.com/emmansun/gmsm < 0.41.1 → 0.41.1
- [GHSA-4jpw-hj22-2xmc](https://erroneo.us/security/ghsa/GHSA-4jpw-hj22-2xmc/index.md) OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE — npm openclaw < 2026.3.11 → 2026.3.11

---
Source page: https://erroneo.us/security/2026-03-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt