--- title: "Security digest: April 21, 2026" url: https://erroneo.us/security/2026-04-21/ description: "April 21, 2026 vulnerability digest: 4 critical advisories (Maven, crates.io (Rust), npm). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-04-21 date_modified: 2026-04-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: April 21, 2026 4 critical advisories. ## Take stock - Maven: 2 critical advisories ( io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo , io.spinnaker.echo:echo-pipelinetriggers ). Check with mvn dependency:tree -Dincludes=: . - crates.io (Rust): 1 critical advisory ( brillig ). Check with cargo audit . - npm: 1 critical advisory ( flowise , flowise-components ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2026-32604](https://erroneo.us/security/cve/CVE-2026-32604/index.md) Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths — Maven io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo < 2026.0.1 → 2026.0.1 - [CVE-2026-41197](https://erroneo.us/security/cve/CVE-2026-41197/index.md) Brillig: Heap corruption in foreign call results with nested tuple arrays — crates.io (Rust) brillig <= 1.0.0-beta.18 → 1.0.0-beta.19 - [CVE-2026-32613](https://erroneo.us/security/cve/CVE-2026-32613/index.md) Spinnaker: RCE via expression parsing due to unrestricted context handling — Maven io.spinnaker.echo:echo-pipelinetriggers >= 2026.0-0, < 2026.0.1 → 2026.0.1; Maven io.spinnaker.echo:echo-pipelinetriggers >= 2025.4-0, < 2025.4.2 → 2025.4.2; Maven io.spinnaker.echo:echo-pipelinetriggers < 2025.3.2 → 2025.3.2 - [CVE-2026-41264](https://erroneo.us/security/cve/CVE-2026-41264/index.md) Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability — npm flowise <= 3.0.13 → 3.1.0; npm flowise-components <= 3.0.13 → 3.1.0 --- Source page: https://erroneo.us/security/2026-04-21/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt