The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site     scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing     rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can     include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript     when sanitized output is placed inside these unprotected rawtext contexts. (CVE-2026-0540)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-0540

medium Nessus Plugin ID 300629

Version 1.5