# What your agent missed in January 2026

In January 2026, CISA added 3 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog and GitHub published 5 critical advisories for widely used npm and PyPI packages.

The ones to know first:

- **Jan 22, 2026**: CVE-2025-31125 added to CISA’s exploited list (Vite). Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125)
- **Jan 8, 2026**: @react-router/node: path traversal in file session storage (critical). Fixed in 7.9.4. [GitHub Advisory Database](https://github.com/advisories/GHSA-9583-h5hc-x8cw)
- **Jan 22, 2026**: CVE-2025-54313 added to CISA’s exploited list (eslint-config-prettier). Prettier eslint-config-prettier contains an embedded malicious code vulnerability. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313)

## Exploited in the wild (3)

- **Jan 22, 2026**: CVE-2025-31125 added to CISA’s exploited list (Vite). Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125)
- **Jan 22, 2026**: CVE-2025-54313 added to CISA’s exploited list (eslint-config-prettier). Prettier eslint-config-prettier contains an embedded malicious code vulnerability. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313)
- **Jan 12, 2026**: CVE-2025-8110 added to CISA’s exploited list (Gogs). Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110)

## Critical advisories (5)

- **Jan 27, 2026**: n8n: n8n unsafe Workflow expression evaluation Allows remote code execution (critical). Fixed in 1.123.17 and 2.4.5. [GitHub Advisory Database](https://github.com/advisories/GHSA-5xrp-6693-jjx9)
- **Jan 8, 2026**: @react-router/node: path traversal in file session storage (critical). Fixed in 7.9.4. [GitHub Advisory Database](https://github.com/advisories/GHSA-9583-h5hc-x8cw)
- **Jan 7, 2026**: n8n: unauthenticated file access via improper webhook request handling (critical). Fixed in 1.121.0. [GitHub Advisory Database](https://github.com/advisories/GHSA-v4pr-fm98-w9pg)
- **Jan 6, 2026**: n8n: RCE via arbitrary file write (critical). Fixed in 1.121.3. [GitHub Advisory Database](https://github.com/advisories/GHSA-v364-rw7m-3263)
- **Jan 5, 2026**: jspdf: local file Inclusion/Path traversal vulnerability (critical). Fixed in 4.0.0. [GitHub Advisory Database](https://github.com/advisories/GHSA-f8cm-6447-x5h2)

## Which models can’t know this

Every model below has a knowledge cutoff before January 2026, so it can’t know about any of this unless a tool gives it live data.

- MAI-Code-1.1-Flash (Microsoft): December 2025
- GPT-5.5 (OpenAI): December 1, 2025
- Claude Sonnet 4.6 (Anthropic): August 2025
- GPT-5.3-Codex (OpenAI): August 31, 2025
- GPT-5.4 (OpenAI): August 31, 2025
- GPT-5.4 Mini (OpenAI): August 31, 2025
- Claude Opus 4.5 (Anthropic): May 2025
- Claude Opus 4.6 (Anthropic): May 2025
- Claude Haiku 4.5 (Anthropic): February 2025
- Claude Sonnet 4.5 (Anthropic): January 2025
- Gemini 2.5 Flash (Google): January 2025
- Gemini 2.5 Pro (Google): January 2025
- Gemini 3 Flash (Google): January 2025
- Gemini 3.1 Pro (Google): January 2025
- GPT-5 (OpenAI): September 30, 2024
- GPT-5-Codex (OpenAI): September 30, 2024
- GPT-5.1 (OpenAI): September 30, 2024
- Llama 4 Maverick (Meta): August 2024
- GPT-4.1 (OpenAI): June 1, 2024
- o3 (OpenAI): June 1, 2024
- GPT-5 Mini (OpenAI): May 31, 2024
- GPT-4o (OpenAI): October 1, 2023

---

Checked Oct 17, 2026 against [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [GitHub Advisory Database](https://github.com/advisories) and [endoflife.date](https://endoflife.date). Full report: https://stackprism.ai/reports/2026-01