StackPrism

Monthly report

What your agent missed in January 2026

In January 2026, CISA added 3 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog and GitHub published 5 critical advisories for widely used npm and PyPI packages.

  • 3Exploited in the wild
  • 5Critical advisories
  • 0Reached end of life
  • 0New release lines

The ones to know first

The most widely used software among this month’s items, one of each kind.

  • CVE-2025-31125 added to CISA’s exploited list (Vite)

    Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import.

    , CISA KEV

  • @react-router/node: path traversal in file session storage (critical)

    Fixed in 7.9.4.

    , GitHub Advisory Database

  • CVE-2025-54313 added to CISA’s exploited list (eslint-config-prettier)

    Prettier eslint-config-prettier contains an embedded malicious code vulnerability.

    , CISA KEV

Everything in January 2026

Exploited in the wild3

  • CVE-2025-31125 added to CISA’s exploited list (Vite)

    Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import.

    , CISA KEV

  • CVE-2025-54313 added to CISA’s exploited list (eslint-config-prettier)

    Prettier eslint-config-prettier contains an embedded malicious code vulnerability.

    , CISA KEV

  • CVE-2025-8110 added to CISA’s exploited list (Gogs)

    Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.

    , CISA KEV

Critical advisories5

  • n8n: n8n unsafe Workflow expression evaluation Allows remote code execution (critical)

    Fixed in 1.123.17 and 2.4.5.

    , GitHub Advisory Database

  • @react-router/node: path traversal in file session storage (critical)

    Fixed in 7.9.4.

    , GitHub Advisory Database

  • n8n: unauthenticated file access via improper webhook request handling (critical)

    Fixed in 1.121.0.

    , GitHub Advisory Database

  • n8n: RCE via arbitrary file write (critical)

    Fixed in 1.121.3.

    , GitHub Advisory Database

  • jspdf: local file Inclusion/Path traversal vulnerability (critical)

    Fixed in 4.0.0.

    , GitHub Advisory Database

Which models can’t know this

These models have a knowledge cutoff before January 2026, so none of them knows about any of this unless a tool gives it live data.

Microsoft

OpenAI

Anthropic

Google

Meta

Claude Fable 5.1, Claude Opus 5.5, Claude Sonnet 5.5, Claude Haiku 5.5, Claude Opus 5, Claude Sonnet 5, Claude Fable 5, Claude Opus 4.8, Claude Opus 4.7, GPT-6.1 Sol, GPT-6 Astra, GPT-6 Sol, GPT-6 Luna, GPT-5.6 Sol, Gemini 4 Argon, Gemini 3.8 Flash, Grok 4.7, Grok 4.6 have cutoffs in or after January 2026, so they may know some of it.

Last checked against CISA KEV, GitHub Advisory Database and endoflife.date.

What counts: vulnerabilities CISA confirms are exploited, in software web apps commonly run; critical GitHub advisories on widely used npm and PyPI packages; and release lines of popular runtimes, frameworks and databases reaching end of life or shipping. Also as Markdown.