ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple
    HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration
    that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close
    inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser
    does not model that mode, content intended to remain inert can survive sanitization and render; the issue
    does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.
    (CVE-2026-113654)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple     HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration     that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close     inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser     does not model that mode, content intended to remain inert can survive sanitization and render; the issue     does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.
    (CVE-2026-113654)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476727	Chainguard: unleash-fips: security update to 8.2.1-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476727	Chainguard: unleash-fips: security update to 8.2.1-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
369009	Linux Distros Unpatched Vulnerability : CVE-2026-113654	Nessus	Misc.	Local	medium
476373	SCA: security update for sanitize-html (GHSA-x3q4-9hxx-gx8m)	Tenable Cloud Security	SCA Checks	Local	medium
476373	SCA: security update for sanitize-html (GHSA-x3q4-9hxx-gx8m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-113654

medium

Tenable Plugins

medium

medium

medium

medium

medium