The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
    Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier,     DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and     discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from     reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent     residue validation. This parser differential can bypass a parse-before-trust well-formedness gate,     although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the     relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed     version is available for xmldom. (CVE-2026-83611)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-83611

medium Nessus Plugin ID 342425

Version 1.2

Version 1.1

Version 1.2 Sep 3, 2026, 1:08 PM CVSS metrics ("CVSSv3 score" set to 6.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609031308
Version 1.1 Sep 3, 2026, 7:44 AM New Plugin Feed: 202609030744