Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script execution in the context of applications that render the SVG.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e25e1b1d0f advisory.

    Update to version 1.2026.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0d819a3a70 advisory.

    Update to version 1.2026.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due
    to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted
    PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script
    execution in the context of applications that render the SVG. (CVE-2026-0858)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due     to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted     PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script     execution in the context of applications that render the SVG. (CVE-2026-0858)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
298345	Fedora 43 : plantuml (2026-e25e1b1d0f)	Nessus	Fedora Local Security Checks	Local	medium
298343	Fedora 42 : plantuml (2026-0d819a3a70)	Nessus	Fedora Local Security Checks	Local	medium
436818	SCA: security update for net.sourceforge.plantuml:plantuml (GHSA-hrvf-g648-rf3m)	Tenable Cloud Security	SCA Checks	Local	medium
436818	SCA: security update for net.sourceforge.plantuml:plantuml (GHSA-hrvf-g648-rf3m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
288877	Linux Distros Unpatched Vulnerability : CVE-2026-0858	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-0858

medium

Tenable Plugins

medium

medium

medium

medium

medium