The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through     4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on     `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been     polluted with a string value whose key matches a partial reference in a template, the polluted string is     used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version     4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in     application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the     Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the     attack surface. (CVE-2026-33916)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-33916

medium Nessus Plugin ID 304162

Version 1.5