ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.

fedora FEDORA-2026-c584e445b8: prometheus-3.15.1-1.fc44

fedora FEDORA-2026-17a53eb219: prometheus-3.15.1-1.fc45

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an
    <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-
    sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each
    nested call with a fresh state. This vulnerability is fixed in 2.18.1. (CVE-2026-113650)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an     <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-     sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each     nested call with a fresh state. This vulnerability is fixed in 2.18.1. (CVE-2026-113650)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476646	Chainguard: librechat: security update to 0.8.8-r4	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476646	Chainguard: librechat: security update to 0.8.8-r4	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
476557	SCA: security update for sanitize-html (GHSA-c9rx-x947-fp3h)	Tenable Cloud Security	SCA Checks	Local	medium
476557	SCA: security update for sanitize-html (GHSA-c9rx-x947-fp3h)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
369008	Linux Distros Unpatched Vulnerability : CVE-2026-113650	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-113650

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium