---
title: "Security digest: April 17, 2026"
url: https://erroneo.us/security/2026-04-17/
description: "April 17, 2026 vulnerability digest: 13 critical advisories (npm, Go, Composer (PHP)…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-17
date_modified: 2026-04-17
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 17, 2026

13 critical advisories.

## Take stock

- npm: 4 critical advisories ( openclaw , flowise , flowise-components , math-codegen ). Check with npm audit (or: npm ls <package>) .
- PyPI: 3 critical advisories ( openviking , sentry , praisonai ). Check with pip-audit (or: pip show <package>) .
- Go: 2 critical advisories ( charm.land/wish/v2 , github.com/charmbracelet/wish , github.com/nhost/nhost ). Check with govulncheck ./... .
- crates.io (Rust): 2 critical advisories ( zebrad , zebra-script , zebra-chain ). Check with cargo audit .
- Composer (PHP): 1 critical advisory ( dolibarr/dolibarr ). Check with composer audit .
- Maven: 1 critical advisory ( org.bouncycastle:bcprov-jdk14 , org.bouncycastle:bcprov-jdk15to18 , org.bouncycastle:bcprov-jdk18on , org.bouncycastle:bcprov-debug-jdk14 , org.bouncycastle:bcprov-debug-jdk15to18 , org.bouncycastle:bcprov-debug-jdk18on , org.bouncycastle:bcprov-ext-jdk14 , org.bouncycastle:bcprov-ext-jdk15to18 …). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-43585](https://erroneo.us/security/cve/CVE-2026-43585/index.md) OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation — npm openclaw < 2026.4.15 → 2026.4.15
- [CVE-2026-41589](https://erroneo.us/security/cve/CVE-2026-41589/index.md) Wish has SCP Path Traversal that allows arbitrary file read/write — Go charm.land/wish/v2 < 2.0.1 → 2.0.1; Go github.com/charmbracelet/wish <= 1.4.7 → no fix
- [CVE-2026-44109](https://erroneo.us/security/cve/CVE-2026-44109/index.md) OpenClaw: Feishu webhook and card-action validation now fail closed — npm openclaw < 2026.4.15 → 2026.4.15
- [CVE-2026-23500](https://erroneo.us/security/cve/CVE-2026-23500/index.md) Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration — Composer (PHP) dolibarr/dolibarr <= 22.0.4 → no fix
- [CVE-2026-41265](https://erroneo.us/security/cve/CVE-2026-41265/index.md) Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability — npm flowise <= 3.0.13 → 3.1.0; npm flowise-components <= 3.0.13 → 3.1.0
- [CVE-2026-41507](https://erroneo.us/security/cve/CVE-2026-41507/index.md) Remote Code Execution (RCE) via String Literal Injection into math-codegen — npm math-codegen < 0.4.3 → 0.4.3
- [CVE-2026-40525](https://erroneo.us/security/cve/CVE-2026-40525/index.md) OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes — PyPI openviking < 0.3.9 → 0.3.9
- [CVE-2026-27197](https://erroneo.us/security/cve/CVE-2026-27197/index.md) Sentry: Improper authentication on SAML SSO process allows user identity linking — PyPI sentry >= 21.12.0, < 26.2.0 → no fix
- [CVE-2026-41497](https://erroneo.us/security/cve/CVE-2026-41497/index.md) PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection — PyPI praisonai <= 4.5.148 → 4.5.149
- [CVE-2026-41583](https://erroneo.us/security/cve/CVE-2026-41583/index.md) Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling — crates.io (Rust) zebrad < 4.3.1 → 4.3.1; crates.io (Rust) zebra-script < 5.0.2 → 5.0.2
- [CVE-2026-41574](https://erroneo.us/security/cve/CVE-2026-41574/index.md) Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass — Go github.com/nhost/nhost < 0.0.0-20260417112436-ec8dab3f2cf4 → 0.0.0-20260417112436-ec8dab3f2cf4
- [CVE-2025-14813](https://erroneo.us/security/cve/CVE-2025-14813/index.md) Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks — Maven org.bouncycastle:bcprov-jdk14 >= 1.59, <= 1.80.1 → no fix; Maven org.bouncycastle:bcprov-jdk15to18 >= 1.59, <= 1.80.1 → no fix; Maven org.bouncycastle:bcprov-jdk18on >= 1.59, <= 1.80.1 → 1.80.2
- [CVE-2026-41584](https://erroneo.us/security/cve/CVE-2026-41584/index.md) Zebra has rk Identity Point Panic in Transaction Verification — crates.io (Rust) zebrad < 4.3.1 → 4.3.1; crates.io (Rust) zebra-chain < 6.0.2 → 6.0.2

---
Source page: https://erroneo.us/security/2026-04-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt