--- title: "Security digest: May 5, 2026" url: https://erroneo.us/security/2026-05-05/ description: "May 5, 2026 vulnerability digest: 17 critical advisories (Composer (PHP), npm, Go…). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-05-05 date_modified: 2026-05-05 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: May 5, 2026 17 critical advisories. ## Take stock - npm: 5 critical advisories ( vm2 , magicmirror ). Check with npm audit (or: npm ls ) . - Composer (PHP): 4 critical advisories ( getgrav/grav , openmage/magento-lts ). Check with composer audit . - PyPI: 4 critical advisories ( firefighter-incident , langflow , django-s3file , codechecker ). Check with pip-audit (or: pip show ) . - Go: 2 critical advisories ( github.com/oxyno-zeta/s3-proxy , github.com/l3montree-dev/devguard ). Check with govulncheck ./... . - Maven: 2 critical advisories ( com.arcadedb:arcadedb-server , org.eclipse.basyx:basyx.sdk ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2026-42607](https://erroneo.us/security/cve/CVE-2026-42607/index.md) Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature — Composer (PHP) getgrav/grav < 2.0.0-beta.2 → 2.0.0-beta.2 - [GHSA-vj3m-2g9h-vm4p](https://erroneo.us/security/ghsa/GHSA-vj3m-2g9h-vm4p/index.md) Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass — Composer (PHP) getgrav/grav < 2.0.0-beta.2 → 2.0.0-beta.2 - [CVE-2026-24781](https://erroneo.us/security/cve/CVE-2026-24781/index.md) VM2 Has Sandbox Breakout Through Inspect Function — npm vm2 <= 3.10.3 → 3.11.0 - [CVE-2026-42882](https://erroneo.us/security/cve/CVE-2026-42882/index.md) S3-Proxy has Security Issues in its Resource Path Matching Implementation — Go github.com/oxyno-zeta/s3-proxy < 0.0.0-20260424211602-1320e4abd46a → 0.0.0-20260424211602-1320e4abd46a - [CVE-2026-24120](https://erroneo.us/security/cve/CVE-2026-24120/index.md) VM2 Has Sandbox Breakout Through Promise Species — npm vm2 <= 3.10.3 → 3.10.5 - [CVE-2026-42613](https://erroneo.us/security/cve/CVE-2026-42613/index.md) Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access — Composer (PHP) getgrav/grav < 2.0.0-beta.2 → 2.0.0-beta.2 - [CVE-2026-42281](https://erroneo.us/security/cve/CVE-2026-42281/index.md) MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint — npm magicmirror <= 2.35.0 → 2.36.0 - [CVE-2026-44221](https://erroneo.us/security/cve/CVE-2026-44221/index.md) ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases — Maven com.arcadedb:arcadedb-server >= 21.10.1, < 26.4.2 → 26.4.2 - [CVE-2026-42864](https://erroneo.us/security/cve/CVE-2026-42864/index.md) FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft — PyPI firefighter-incident < 0.0.54 → 0.0.54 - [CVE-2026-26956](https://erroneo.us/security/cve/CVE-2026-26956/index.md) VM2 Has a WASM Sandbox Escape — npm vm2 <= 3.10.4 → 3.10.5 - [CVE-2026-42048](https://erroneo.us/security/cve/CVE-2026-42048/index.md) Langflow Knowledge Bases API is Vulnerable to Path Traversal — PyPI langflow <= 1.8.4 → 1.9.0 - [CVE-2026-7411](https://erroneo.us/security/cve/CVE-2026-7411/index.md) Eclipse BaSyx Java Server SDK vulnerable to Path Traversal — Maven org.eclipse.basyx:basyx.sdk < 2.0.0-milestone-10 → 2.0.0-milestone-10 - [CVE-2026-42196](https://erroneo.us/security/cve/CVE-2026-42196/index.md) django-s3file is vulnerable to relative path traversal — PyPI django-s3file <= 7.0.1 → 7.0.2 - [CVE-2026-26332](https://erroneo.us/security/cve/CVE-2026-26332/index.md) VM2 Has a Sandbox Escape Issue via SuppressedError — npm vm2 <= 3.10.4 → 3.11.0 - [CVE-2026-25660](https://erroneo.us/security/cve/CVE-2026-25660/index.md) Codechecker has an authentication bypass for certain API calls — PyPI codechecker <= 6.27.3 → no fix - [CVE-2026-42300](https://erroneo.us/security/cve/CVE-2026-42300/index.md) DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header — Go github.com/l3montree-dev/devguard < 1.2.2 → 1.2.2 - [CVE-2026-42155](https://erroneo.us/security/cve/CVE-2026-42155/index.md) Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs — Composer (PHP) openmage/magento-lts <= 20.17.0 → 20.18.0 --- Source page: https://erroneo.us/security/2026-05-05/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt