Detections
Analytics
SCA: security update for ghtml (GHSA-vvhj-v88f-5gxr)
high Tenable Self-Hosted Container Security Plugin ID 419548
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- ghtml is software that uses tagged templates for template engine functionality. It is possible to
introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some
cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated
documentation to clarify that while ghtml escapes characters with special meaning in HTML, it does not
provide comprehensive protection against all types of XSS attacks in every scenario. This aligns with the
approach taken by other template engines. Developers should be cautious and take additional measures to
sanitize user input and prevent potential vulnerabilities. Additionally, the backtick character (`) is now
also escaped to prevent the creation of strings in most cases where a malicious actor somehow gains the
ability to write JavaScript. This does not provide comprehensive protection either. (CVE-2024-37166)
See Also
Plugin Details
Severity: High
ID: 419548
Version: Revision 1.10
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.59
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 8.7
Temporal Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:P
CVSS Score Source: CVE-2024-37166
CVSS v3
Risk Factor: High
Base Score: 8.9
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/10/2024
Vulnerability Publication Date: 6/10/2024
Reference Information
CVE: CVE-2024-37166