Security Digest: February 5, 2026 - 7 Critical Vulnerabilities
Today's security landscape is dominated by seven critical vulnerabilities, primarily affecting sandbox environments and database systems.
· 4 min read
Executive Summary
Today's security landscape is dominated by seven critical vulnerabilities, primarily affecting sandbox environments and database systems. Immediate action is required to patch these vulnerabilities to prevent remote code execution and data breaches.
Critical Vulnerabilities
- CVE-2026-25520: SandboxJS Function Bypass
- Impact: Remote code execution (RCE) via sandbox escape.
- Affected Systems: npm package @nyariv/sandboxjs
- Immediate Action: Cease usage of @nyariv/sandboxjs and apply any available patches.
- Mitigation: Switch to a more secure sandboxing solution.
- CVE-2026-25587: Map Prototype Exploit
- Impact: RCE by overwriting Map.prototype.has.
- Affected Systems: npm package @nyariv/sandboxjs
- Immediate Action: Update or disable the vulnerable package.
- Mitigation: Implement strict input validation and apply available patches.
- CVE-2026-25586: Prototype Pollution in SandboxJS
- Impact: Host Object.prototype pollution leading to persistent cross-sandbox impact.
- Affected Systems: npm package @nyariv/sandboxjs
- Immediate Action: Disable @nyariv/sandboxjs in production environments.
- Mitigation: Apply patches and use safer alternatives.
- CVE-2026-25544: SQL Injection in Payload CMS
- Impact: Blind SQL injection allowing data extraction and account takeover.
- Affected Systems: Payload CMS versions < v3.73.0 with specific database adapters
- Immediate Action: Upgrade to Payload v3.73.0 or later.
- Mitigation: Ensure all JSON/richText fields have restricted read access.
- CVE-2026-25628: Arbitrary File Append in Qdrant
- Impact: Potential privilege escalation via log file manipulation.
- Affected Systems: Qdrant version 1.15.5
- Immediate Action: Restrict /logger endpoint access.
- Mitigation: Patch to limit log file paths strictly.
- CVE-2026-23989: Scope Bypass in Reva Products
- Impact: Unauthorized access to resources outside intended scope.
- Affected Systems: OpenCloud Reva < 2.40.3 (for 2.40.x) and < 2.42.3 (for 2.41.x)
- Immediate Action: Update to the latest Reva version.
- Mitigation: Follow OpenCloud's advisory for mitigation steps.
- CVE-2026-25732: Path Traversal in NiceGUI
- Impact: Potential for RCE via unsanitized file uploads.
- Affected Systems: Applications using NiceGUI's ui.upload() improperly
- Immediate Action: Ensure file names are sanitized before saving.
- Mitigation: Use safe handling code as detailed in remediation guidance.
Previously Alerted
What to Do Now
- Review and patch affected systems immediately.
- Verify the integrity of systems by checking for signs of exploitation.
- Enhance monitoring to detect any related suspicious activities.