Security Digest: February 10, 2026 - 4 Critical Vulnerabilities

Today, four critical vulnerabilities demand immediate attention. These include a CRITICAL sandbox escape in JavaScript environments and file access bypass in Go applications.

· 4 min read

Executive Summary

Today, four critical vulnerabilities demand immediate attention. These include a CRITICAL sandbox escape in JavaScript environments, file access bypass in Go applications, a privilege escalation in Cube.js, and a denial of service in Adminer. Immediate mitigation is crucial to protect systems from potential exploitation.

Critical Vulnerabilities

  • CVE-2026-25881: Sandbox Escape via Prototype Pollution
    • Impact: Enables remote code execution (RCE) by mutating global prototypes, affecting JavaScript environments using @nyariv/sandboxjs.
    • Affected Systems: Applications using @nyariv/sandboxjs.
    • Immediate Action: Freeze built-in prototypes and prevent untrusted code from running without patching.
    • Mitigation: Update to a version that preserves protection flags; implement hard blocks on prototype mutations.
  • CVE-2026-25890: File Path Bypass
    • Impact: Unauthorized access to restricted files by bypassing path rules.
    • Affected Systems: Systems using filebrowser on Go.
    • Immediate Action: Adjust router configuration to properly handle URL path normalization.
    • Mitigation: Reconfigure to collapse multiple slashes in paths.
  • CVE-2026-25958: Privilege Escalation in Cube.js
    • Impact: Allows unauthorized privilege escalation via crafted API requests.
    • Affected Systems: Cube.js versions >= 0.27.19.
    • Immediate Action: Upgrade to Cube.js 1.5.13 or later.
    • Mitigation: Apply the patch from Cube.js 1.5.13 to secure systems.
  • CVE-2026-25892: Denial of Service in Adminer
    • Impact: Persistent denial of service by leveraging a type confusion error.
    • Affected Systems: Adminer v5.4.1.
    • Immediate Action: Upgrade to Adminer 5.4.2 immediately.
    • Mitigation: Make the adminer.version file unwritable by the web server if upgrading is not immediately possible.

What to Do Now

  1. Patch Immediately: Apply patches for all affected systems as per the latest advisories.
  2. Restrict Access: Limit permissions for vulnerable applications and isolate them from critical systems.
  3. Monitor Systems: Implement monitoring to detect unusual access patterns or prototype mutations.
  4. Verify Protection: Ensure that all affected configurations are updated and verified for security compliance.

Related Resources

Keep reading