ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that attributeName selecting href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3942ab86fd advisory.

    See https://github.com/jupytext/jupytext/blob/main/CHANGELOG.md for changes in versions 1.19.5 and 1.19.6.
    For this update, a patch has been applied that reverses the jupyterlab  jupyter-builder change for     Fedora releases  45, since jupyter-builder is only available in F46 and later.  Many CVEs have been     fixed in this release.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1e56ab167d advisory.

    Update to 3.15.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0ed67903d8 advisory.

    Update to 3.15.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple
    HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js
    validates an animation value attribute as one flat URL and does not recognize that attributeName selecting
    href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In
    configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a
    values list can begin with a safe fragment and contain a later executable destination that survives
    allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that
    later destination into the live link, and a victim who activates the link can execute script in the
    application's origin. This issue is fixed in version 2.17.7. (CVE-2026-84371)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple     HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js     validates an animation value attribute as one flat URL and does not recognize that attributeName selecting     href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In     configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a     values list can begin with a safe fragment and contain a later executable destination that survives     allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that     later destination into the live link, and a victim who activates the link can execute script in the     application's origin. This issue is fixed in version 2.17.7. (CVE-2026-84371)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365513	Fedora 43 : python-jupytext (2026-3942ab86fd)	Nessus	Fedora Local Security Checks	Local	high
362883	Fedora 44 : prometheus (2026-1e56ab167d)	Nessus	Fedora Local Security Checks	Local	high
362819	Fedora 45 : prometheus (2026-0ed67903d8)	Nessus	Fedora Local Security Checks	Local	high
461323	Echo: sanitize-html: security update to 2.17.7	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461323	Echo: sanitize-html: security update to 2.17.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
342408	Linux Distros Unpatched Vulnerability : CVE-2026-84371	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-84371

medium

Tenable Plugins

high

high

high

medium

medium

medium