CVE-2026-5160 affecting package gh for versions less than 2.62.0-15

CVE-2026-5160 affecting package gh for versions less than 2.62.0-15. A patched version of the package is available...

Fedora 44 : vhs (2026-94fbf80bec)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-94fbf80bec advisory. Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160. Tenable has extracted the preceding description block directly from the Fedora security advisory...

CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...