---
title: "Security digest: May 29, 2026"
url: https://erroneo.us/security/2026-05-29/
description: "May 29, 2026 vulnerability digest: 1 CISA KEV addition (Palo Alto Networks); 16 critical advisories (PyPI, npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-05-29
date_modified: 2026-05-29
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 29, 2026

1 known exploited (cisa kev) addition and 16 critical advisories.

## Take stock

- Do you run any of these? Palo Alto Networks PAN-OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-01.
- PyPI: 11 critical advisories ( PraisonAI , stigmem-node , praisonai-platform , praisonaiagents , redshift-connector ). Check with pip-audit (or: pip show <package>) .
- npm: 5 critical advisories ( vm2 ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-0257](https://erroneo.us/security/cve/CVE-2026-0257/index.md) Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (CISA due 2026-06-01)

## Critical advisories

- [CVE-2026-47391](https://erroneo.us/security/cve/CVE-2026-47391/index.md) PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution — PyPI PraisonAI <= 4.6.39 → 4.6.40
- [CVE-2026-47131](https://erroneo.us/security/cve/CVE-2026-47131/index.md) vm2 has a Sandbox Escape issue — npm vm2 <= 3.11.3 → 3.11.4
- [CVE-2026-47140](https://erroneo.us/security/cve/CVE-2026-47140/index.md) NodeVM builtin denylist bypass via process and inspector/promises allows host code execution — npm vm2 <= 3.11.3 → 3.11.4
- [CVE-2026-47137](https://erroneo.us/security/cve/CVE-2026-47137/index.md) vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE — npm vm2 <= 3.11.3 → 3.11.4
- [GHSA-jmfc-hfjq-pxcp](https://erroneo.us/security/ghsa/GHSA-jmfc-hfjq-pxcp/index.md) stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation — PyPI stigmem-node < 0.9.0a2 → 0.9.0a2
- [CVE-2026-47407](https://erroneo.us/security/cve/CVE-2026-47407/index.md) PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation — PyPI praisonai-platform <= 0.1.2 → 0.1.4
- [GHSA-fp6w-8wpg-74g5](https://erroneo.us/security/ghsa/GHSA-fp6w-8wpg-74g5/index.md) stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback — PyPI stigmem-node < 0.9.0a2 → 0.9.0a2
- [CVE-2026-47416](https://erroneo.us/security/cve/CVE-2026-47416/index.md) praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id} — PyPI praisonai-platform <= 0.1.2 → 0.1.4
- [GHSA-9vp8-3hmv-8fgh](https://erroneo.us/security/ghsa/GHSA-9vp8-3hmv-8fgh/index.md) stigmem-node's federation peer registration lacked explicit out-of-band approval — PyPI stigmem-node < 0.9.0a2 → 0.9.0a2
- [CVE-2026-47396](https://erroneo.us/security/cve/CVE-2026-47396/index.md) PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset — PyPI PraisonAI <= 4.6.39 → 4.6.40
- [CVE-2026-47393](https://erroneo.us/security/cve/CVE-2026-47393/index.md) PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default — PyPI PraisonAI <= 4.6.39 → 4.6.40
- [CVE-2026-47208](https://erroneo.us/security/cve/CVE-2026-47208/index.md) vm2 is Vulnerable to Sandbox Breakout Through Promise Species — npm vm2 <= 3.11.3 → 3.11.4
- [CVE-2026-47210](https://erroneo.us/security/cve/CVE-2026-47210/index.md) vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass — npm vm2 <= 3.11.3 → 3.11.4
- [CVE-2026-47392](https://erroneo.us/security/cve/CVE-2026-47392/index.md) PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) — PyPI praisonaiagents <= 1.6.39 → 1.6.40; PyPI PraisonAI <= 4.6.39 → 4.6.40
- [CVE-2026-47410](https://erroneo.us/security/cve/CVE-2026-47410/index.md) praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset — PyPI praisonai-platform <= 0.1.2 → 0.1.4
- [CVE-2026-8838](https://erroneo.us/security/cve/CVE-2026-8838/index.md) amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection — PyPI redshift-connector <= 2.1.13 → 2.1.14

---
Source page: https://erroneo.us/security/2026-05-29/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt