--- title: "Security digest: September 3, 2026" url: https://erroneo.us/security/2026-09-03/ description: "September 3, 2026 vulnerability digest: 3 briefs (ScreenConnect CVE-2026-84869: Guest-to-Host File…); 14 critical advisories (npm, Go, PyPI). What to patch…" type: security-digest-day section: "Security Digest" date_published: 2026-09-03 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 3, 2026 3 editorial briefs and 14 critical advisories. ## Take stock - Act now: ScreenConnect CVE-2026-84869: Guest-to-Host File Execution . MSPs, help desks and IT teams using on-premises ScreenConnect below 26.6.5, or using any ScreenConnect deployment whose technicians still run old host clients, especially when supporting untrusted or consumer endpoints. - Act now: MikroTrick . Anyone running RouterOS 6 or 7, most urgently where SSH, WebFig or the bandwidth-test server is reachable from the internet or another untrusted network. - Check exposure: Chrome V8 Zero-Days CVE-2026-85046 and CVE-2026-87491 . Admins of fleets where Chrome or Edge updates are pinned, deferred or broken, owners of kiosk and VDI images, and users of Chromium-based browsers whose vendor has not shipped a September 2026 or later V8 fix. - npm: 9 critical advisories ( orval ). Check with npm audit (or: npm ls ) . - Go: 3 critical advisories ( github.com/siyuan-note/siyuan/kernel ). Check with govulncheck ./... . - PyPI: 2 critical advisories ( unstructured , python-jose ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [ScreenConnect CVE-2026-84869: Guest-to-Host File Execution](https://erroneo.us/security/briefs/connectwise-screenconnect-cve-2026-84869-guest-file-execution/index.md): If your technicians use a ScreenConnect client older than 26.6.5, a compromised machine they connect to can run code on theirs; upgrade on-premises servers and reinstall host clients now. - **Act now** [MikroTrick: Exploited MikroTik RouterOS SSH Takeover Chain](https://erroneo.us/security/briefs/mikrotik-routeros-mikrotrick-ssh-cve-2026-86060/index.md): If you run MikroTik routers, upgrade them now and check for an 'ops' admin account; an unauthenticated SSH chain to full admin was exploited a day before patches shipped. - **Check exposure** [Chrome V8 Zero-Days CVE-2026-85046 and CVE-2026-87491](https://erroneo.us/security/briefs/chrome-v8-cve-2026-85046-87491-exploited-zero-days/index.md): Both were exploited zero-days, but Chrome and Edge fixed them in early September and auto-update has had six weeks to deliver the fix; the job now is finding browsers that did not update, not a scramble. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2026-72717](https://erroneo.us/security/cve/CVE-2026-72717/index.md) Orval: Import-time RCE via schema default -> zod module-level template literal — npm orval < 8.21.0 → 8.21.0 - [CVE-2026-69084](https://erroneo.us/security/cve/CVE-2026-69084/index.md) SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721002947-23a17d44b5f3 → 0.0.0-20260721002947-23a17d44b5f3 - [CVE-2026-72811](https://erroneo.us/security/cve/CVE-2026-72811/index.md) SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260723004839-1a5b3431d5ab → 0.0.0-20260723004839-1a5b3431d5ab - [CVE-2026-69083](https://erroneo.us/security/cve/CVE-2026-69083/index.md) SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721004815-cf42dd5680c8 → 0.0.0-20260721004815-cf42dd5680c8 - [CVE-2026-62681](https://erroneo.us/security/cve/CVE-2026-62681/index.md) Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) — npm orval < 8.21.0 → 8.21.0 - [CVE-2026-71871](https://erroneo.us/security/cve/CVE-2026-71871/index.md) Orval: Import-time RCE via header-parameter default -> zod module-level template literal — npm orval < 8.21.0 → 8.21.0 - [CVE-2026-62682](https://erroneo.us/security/cve/CVE-2026-62682/index.md) Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) — npm orval < 8.21.0 → 8.21.0 - [CVE-2026-71865](https://erroneo.us/security/cve/CVE-2026-71865/index.md) Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli — npm orval < 8.21.0 → 8.21.0 - [CVE-2026-71864](https://erroneo.us/security/cve/CVE-2026-71864/index.md) Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client — npm orval < 8.21.0 → 8.21.0 - [CVE-2026-71428](https://erroneo.us/security/cve/CVE-2026-71428/index.md) unstructured: Server-Side Request Forgery in the URL-based partitioning — PyPI unstructured >= 0.4.7, < 0.24.0 → 0.24.0 - [CVE-2026-85394](https://erroneo.us/security/cve/CVE-2026-85394/index.md) python-jose algorithm confusion guard bypassed by DER-encoded public keys — PyPI python-jose <= 3.5.0 → no fix - [CVE-2026-71868](https://erroneo.us/security/cve/CVE-2026-71868/index.md) Orval: Import-time RCE via enum-typed default -> zod module-level template literal — npm orval < 8.21.0 → 8.21.0 - [CVE-2026-71867](https://erroneo.us/security/cve/CVE-2026-71867/index.md) Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator — npm orval < 8.21.0 → 8.21.0 - [CVE-2026-71869](https://erroneo.us/security/cve/CVE-2026-71869/index.md) Orval: Import-time RCE via array-items default -> zod module-level template literal — npm orval < 8.21.0 → 8.21.0 --- Source page: https://erroneo.us/security/2026-09-03/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt