Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in     gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path     components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a     file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.
    (CVE-2026-54659)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in
    gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path
    components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a
    file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.
    (CVE-2026-54659)

ID	Name	Product	Family	Type	Severity
374746	Linux Distros Unpatched Vulnerability : CVE-2026-54659	Nessus	Misc.	Local	medium
445419	SCA: security update for pagy (GHSA-2xmw-f8j8-wfxc)	Tenable Cloud Security	SCA Checks	Local	medium
445419	SCA: security update for pagy (GHSA-2xmw-f8j8-wfxc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54659

medium

Tenable Plugins

medium

medium

medium