Security Digest: February 4, 2026 - 10 Critical Vulnerabilities

Today's security landscape is marked by 10 critical vulnerabilities affecting various applications, including path traversal and command injection flaws.

· 5 min read

Today's Critical Security Threats

Executive Summary

Today's security landscape is marked by 10 critical vulnerabilities affecting various applications, including path traversal and command injection flaws. Immediate action is required to patch these vulnerabilities and secure your systems.

Critical Vulnerabilities

  • CVE-2026-25161: Path Traversal in Alist
    • Impact: Unauthorized file operations across user boundaries.
    • Affected Systems: go github.com/alist-org/alist/v3
    • Immediate Action: Apply the latest patch from the vendor.
    • Mitigation: Ensure directory validation is handled properly.
  • CVE-2026-24843: Path Traversal in Melange
    • Impact: Unauthorized file writes on the host system.
    • Affected Systems: go chainguard.dev/melange
    • Immediate Action: Upgrade to the latest version with commit 6e243d0d.
  • CVE-2026-25143: Shell Command Injection in Melange
    • Impact: Execution of arbitrary commands on the build host.
    • Affected Systems: go chainguard.dev/melange
    • Immediate Action: Update to version 0.40.3 immediately.
  • CVE-2026-24844: Command Injection in Build Pipelines
    • Impact: Arbitrary shell command execution.
    • Affected Systems: go chainguard.dev/melange
    • Immediate Action: Apply fix with commit e51ca30c.
  • CVE-2026-25546: Remote Code Execution in Godot-MCP
    • Impact: Execution of commands with server privileges.
    • Affected Systems: npm @coding-solo/godot-mcp
    • Immediate Action: Upgrade to version 0.1.1.
  • CVE-2025-61917: Unsafe Buffer Allocation in n8n
    • Impact: Potential information disclosure via uninitialized memory.
    • Affected Systems: npm n8n
    • Immediate Action: Upgrade to version ≥ 1.114.3.
  • CVE-2026-25121: Path Traversal in Apko
    • Impact: Unauthorized directory creation outside intended root.
    • Affected Systems: go chainguard.dev/apko
    • Immediate Action: Apply the patch with commit d8b7887.
  • CVE-2026-23897: DoS Vulnerability in Apollo Server
    • Impact: Denial of Service via crafted request bodies.
    • Affected Systems: npm apollo-server
    • Immediate Action: Update to version 5.4.0 or 4.13.0.
  • CVE-2026-25140: Resource Exhaustion in Apko
    • Impact: Denial of Service through resource exhaustion.
    • Affected Systems: go chainguard.dev/apko
    • Immediate Action: Fix with commit 2be3903.
  • CVE-2026-25536: Data Leak in MCP Server
    • Impact: Cross-client data leakage via shared server instances.
    • Affected Systems: npm @modelcontextprotocol/sdk
    • Immediate Action: Implement separate instances per client connection as per new guidelines.

Previously Alerted

What to Do Now

  1. Verify all systems for the vulnerabilities listed above.
  2. Apply patches or recommended workarounds immediately.
  3. Monitor systems for irregular activities post-patch.

Related Resources

  • Vendor advisories, detailed in CVE descriptions above.

Keep reading