Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5df889949e advisory.

    Update to 2.92.0 and make telemetry sending opt in.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-94fbf80bec advisory.

    Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a2ff381f7 advisory.

    Automatic update for subfinder-2.14.0-1.fc45.

    ##### **Changelog**

    ```
    * Tue Apr 28 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2.14.0-1
    - Update to 2.14.0 - Closes rhbz#2463149 rhbz#2458997 rhbz#2456046

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-10cf6ce616 advisory.

    Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site     Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link     destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an     attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character     references. For example, a payload such as javascript:alert(1) is not recognized as dangerous during     validation, leading to arbitrary script execution in the context of applications that render the URL.
    (CVE-2026-5160)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
313027	Fedora 44 : gh (2026-5df889949e)	Nessus	Fedora Local Security Checks	medium
311380	Fedora 44 : vhs (2026-94fbf80bec)	Nessus	Fedora Local Security Checks	medium
310723	Fedora 45 : subfinder (2026-3a2ff381f7)	Nessus	Fedora Local Security Checks	medium
310594	Fedora 44 : gum (2026-10cf6ce616)	Nessus	Fedora Local Security Checks	medium
306637	Linux Distros Unpatched Vulnerability : CVE-2026-5160	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-5160

medium

Tenable Plugins

medium

medium

medium

medium

medium