Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via output_sonar(). It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents. This issue has been fully patched in Version 2.0.20 (released 2026-05-16). There is no configuration-based workaround within older versions of flawfinder. If an immediate upgrade is not possible, users can mitigate the risk by pre-scanning filenames, inspecting raw output, and/or restricting untrusted inputs.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to     2.0.20 have an improper input neutralization issue leading to output manipulation, specifically,     Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contains ANSI     escape sequences can end up being included in flawfinder's standard terminal output, with many effects.
    Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when     generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary     XML attributes into SonarQube outputs via output_sonar(). It impacts those who use flawfinder to evaluate     intentionally malicious filenames or file contents. This issue has been fully patched in Version 2.0.20     (released 2026-05-16). There is no configuration-based workaround within older versions of flawfinder. If     an immediate upgrade is not possible, users can mitigate the risk by pre-scanning filenames, inspecting     raw output, and/or restricting untrusted inputs. (CVE-2026-48813)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to
    2.0.20 have an improper input neutralization issue leading to output manipulation, specifically,
    Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contains ANSI
    escape sequences can end up being included in flawfinder's standard terminal output, with many effects.
    Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when
    generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary
    XML attributes into SonarQube outputs via output_sonar(). It impacts those who use flawfinder to evaluate
    intentionally malicious filenames or file contents. This issue has been fully patched in Version 2.0.20
    (released 2026-05-16). There is no configuration-based workaround within older versions of flawfinder. If
    an immediate upgrade is not possible, users can mitigate the risk by pre-scanning filenames, inspecting
    raw output, and/or restricting untrusted inputs. (CVE-2026-48813)

ID	Name	Product	Family	Type	Severity
335310	Linux Distros Unpatched Vulnerability : CVE-2026-48813	Nessus	Misc.	Local	high
444075	SCA: security update for flawfinder (GHSA-4c3c-r6p8-c863)	Tenable Cloud Security	SCA Checks	Local	high
444075	SCA: security update for flawfinder (GHSA-4c3c-r6p8-c863)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-48813

high

Tenable Plugins

high

high

high