ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple
    HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows
    meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect
    destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.
    (CVE-2026-113661)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple     HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows     meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect     destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.
    (CVE-2026-113661)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476682	Chainguard: unleash-fips: security update to 8.2.1-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476682	Chainguard: unleash-fips: security update to 8.2.1-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
369054	Linux Distros Unpatched Vulnerability : CVE-2026-113661	Nessus	Misc.	Local	medium
476365	SCA: security update for sanitize-html (GHSA-cv27-6wvh-8x7j)	Tenable Cloud Security	SCA Checks	Local	medium
476365	SCA: security update for sanitize-html (GHSA-cv27-6wvh-8x7j)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-113661

medium

Tenable Plugins

medium

medium

medium

medium

medium