Skip to content

Commit 352c185

Browse files
jasnowjasnow
authored
Merge pull request #1130 from connorshea/nokogiri-cves
GHSA/SYNC: Add 8 new nokogiri advisories. LGTM
2 parents 5c8bbd6 + f560942 commit 352c185

8 files changed

Lines changed: 405 additions & 0 deletions

‎gems/nokogiri/GHSA-5prr-v3j2-97mh.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
gem: nokogiri
3+
ghsa: 5prr-v3j2-97mh
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5prr-v3j2-97mh
5+
title: 'Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`'
6+
date: 2026-06-19
7+
description: |
8+
### Summary
9+
10+
`Nokogiri::XML::NodeSet#[]` (and its alias `#slice`) checked the requested
11+
index against the node set's bounds using a 32-bit-truncated copy of the
12+
index. A large negative index could pass the check and then be used at full
13+
width, reading outside the node set's storage. On CRuby this is an
14+
out-of-bounds read that typically crashes the process; on JRuby it is not
15+
memory-unsafe but returns an incorrect node.
16+
17+
Nokogiri 1.19.4 performs the bounds check against the full-width index.
18+
19+
### Severity
20+
21+
The Nokogiri maintainers have evaluated this as medium severity.
22+
23+
Exploitation requires an application to pass an attacker-controlled integer to
24+
`NodeSet#[]`. The primary impact is a controlled crash (denial of service),
25+
with potential for memory disclosure on CRuby.
26+
27+
On JRuby, Nokogiri is not affected by this vulnerability.
28+
29+
### Mitigation
30+
31+
Upgrade to Nokogiri 1.19.4 or later.
32+
33+
As a workaround, applications that index a `NodeSet` with externally-supplied
34+
integers can validate the index against `node_set.length` before use, or avoid
35+
passing untrusted values as an index.
36+
37+
### Credit
38+
39+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
40+
cvss_v4: 6.3
41+
patched_versions:
42+
- ">= 1.19.4"
43+
related:
44+
url:
45+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5prr-v3j2-97mh
46+
- https://github.com/advisories/GHSA-5prr-v3j2-97mh

‎gems/nokogiri/GHSA-5v8h-3h3q-446p.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
gem: nokogiri
3+
ghsa: 5v8h-3h3q-446p
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p
5+
title: 'Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=`
6+
raises an exception'
7+
date: 2026-06-19
8+
description: |
9+
### Summary
10+
11+
Calling `Document#encoding=` with an invalid encoding (e.g., a non-string, or
12+
a string containing a null byte) raises an exception, but only after freeing
13+
the document's current encoding string without replacing it. The document is
14+
left referencing freed memory, so the next call to `Document#encoding` reads
15+
invalid memory, which can cause a segfault or leak freed bytes into a Ruby
16+
`String`.
17+
18+
Affects the CRuby (libxml2) implementation only; JRuby is not affected.
19+
20+
### Severity
21+
22+
The Nokogiri maintainers have evaluated this as low severity. Reaching it
23+
requires an unusual API-usage pattern that does not arise during normal use.
24+
The application must pass an invalid encoding to `Document#encoding=`, rescue
25+
the resulting exception, and then continue using the same document. Nokogiri
26+
1.19.4 makes this pattern safe with no change to the public API. The document
27+
no longer references freed memory after the exception is raised.
28+
29+
### Mitigation
30+
31+
Upgrade to Nokogiri 1.19.4 or later.
32+
33+
If users are unable to upgrade, avoid passing attacker-controlled values to
34+
`Document#encoding=`. Applications that only assign developer-authored
35+
encodings are not directly exposed.
36+
37+
### Credit
38+
39+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
40+
cvss_v4: 1.7
41+
patched_versions:
42+
- ">= 1.19.4"
43+
related:
44+
url:
45+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p
46+
- https://github.com/advisories/GHSA-5v8h-3h3q-446p

‎gems/nokogiri/GHSA-8678-w3jw-xfc2.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
gem: nokogiri
3+
ghsa: 8678-w3jw-xfc2
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2
5+
title: 'Nokogiri: XML::Schema on JRuby allows network requests when NONET is set,
6+
bypassing CVE-2020-26247'
7+
date: 2026-06-19
8+
description: |
9+
### Summary
10+
11+
The `NONET` parse option, which Nokogiri turns on by default for
12+
`Nokogiri::XML::Schema` (see
13+
[CVE-2020-26247](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m)),
14+
was not correctly enforced on the JRuby implementation. As a result, a schema
15+
parsed with default options could still cause external resources to be fetched
16+
over the network, potentially enabling SSRF or XXE attacks.
17+
18+
Nokogiri 1.19.4 replaces the scheme denylist with an allowlist. When `NONET`
19+
is enabled, only local resources (a `file:` scheme, or a relative or absolute
20+
path with no scheme) are resolved, and every network scheme is blocked,
21+
case-insensitively. This brings the JRuby behavior in line with CRuby.
22+
23+
Only the JRuby implementation is affected. CRuby is not affected, because
24+
libxml2's `xmlNoNetExternalEntityLoader` blocks all network schemes at the I/O
25+
layer regardless of scheme or case.
26+
27+
### Severity
28+
29+
The Nokogiri maintainers have evaluated this as low severity (CVSS 2.6,
30+
`CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N`). It is a bypass of
31+
CVE-2020-26247, which was scored the same way.
32+
33+
### Mitigation
34+
35+
Upgrade to Nokogiri 1.19.4 or later.
36+
37+
There are no known workarounds for affected versions.
38+
39+
This change properly enforces `NONET` on JRuby, which is a breaking change for
40+
any code that (perhaps unknowingly) relied on the previous behavior to load
41+
network resources with default parse options. If you trust your input and want
42+
to allow external resources to be accessed over the network, you can
43+
explicitly disable `NONET`, exactly as documented for CVE-2020-26247:
44+
45+
1. Ensure the input is trusted. Do not enable this option for untrusted input.
46+
2. Pass a `Nokogiri::XML::ParseOptions` with the `NONET` flag turned off:
47+
48+
``` ruby
49+
# allows resources to be accessed over the network for trusted input
50+
schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)
51+
```
52+
53+
### References
54+
55+
- Bypass of: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m
56+
57+
### Credit
58+
59+
This issue was responsibly reported by @bilerden.
60+
cvss_v3: 2.6
61+
patched_versions:
62+
- ">= 1.19.4"
63+
related:
64+
url:
65+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2
66+
- https://github.com/advisories/GHSA-8678-w3jw-xfc2

‎gems/nokogiri/GHSA-9cv2-cfxc-v4v2.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
gem: nokogiri
3+
ghsa: 9cv2-cfxc-v4v2
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2
5+
title: 'Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper
6+
classes'
7+
date: 2026-06-19
8+
description: |
9+
### Summary
10+
11+
Nokogiri contains a bug when calling certain methods on
12+
allocated-but-uninitialized native wrapper classes that inherit from
13+
`Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash
14+
the process.
15+
16+
Nokogiri 1.19.4 checks for missing native data pointers and raises a
17+
`RuntimeError`.
18+
19+
JRuby is not affected.
20+
21+
### Severity
22+
23+
The Nokogiri maintainers have evaluated this as low severity. This is only
24+
triggered by a programming error. It requires application code to call
25+
`.allocate` directly on a native-backed class and then invoke methods on the
26+
resulting uninitialized object. It cannot be triggered by untrusted input or
27+
through normal use of the public API.
28+
29+
### Mitigation
30+
31+
Upgrade to Nokogiri 1.19.4 or later.
32+
33+
Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the
34+
documented constructors and factory methods instead.
35+
36+
### Credit
37+
38+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
39+
cvss_v4: 1.7
40+
patched_versions:
41+
- ">= 1.19.4"
42+
related:
43+
url:
44+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2
45+
- https://github.com/advisories/GHSA-9cv2-cfxc-v4v2

‎gems/nokogiri/GHSA-p67v-3w7g-wjg7.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
gem: nokogiri
3+
ghsa: p67v-3w7g-wjg7
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7
5+
title: 'Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext`
6+
beyond document lifetime'
7+
date: 2026-06-19
8+
description: |
9+
### Summary
10+
11+
`Nokogiri::XML::XPathContext` did not keep its source document alive for
12+
garbage collection. If an `XPathContext` outlived its document and the
13+
document was collected, evaluating an XPath expression could read invalid
14+
memory and potentially segfault.
15+
16+
This is only reachable when application code constructs an `XPathContext`
17+
directly and lets the document become unreachable while continuing to use the
18+
context. The normal `Document#xpath`, `#css`, and related search methods are
19+
not affected, and it is not triggerable by malicious document input.
20+
21+
Nokogiri 1.19.4 makes `XPathContext` keep its source document alive for as
22+
long as the context exists.
23+
24+
Only the CRuby implementation is affected. JRuby is not affected.
25+
26+
### Severity
27+
28+
The Nokogiri maintainers have evaluated this as low severity. Reaching it
29+
requires an unusual API-usage pattern that does not arise during normal use.
30+
The application must construct an `XML::XPathContext` directly and continue
31+
using it after allowing its source document to be garbage-collected. Nokogiri
32+
1.19.4 makes this pattern safe with no change to the public API. The context
33+
now keeps its source document alive for as long as it exists.
34+
35+
### Mitigation
36+
37+
Upgrade to Nokogiri 1.19.4 or later.
38+
39+
As a workaround, ensure the source document remains referenced for as long as
40+
any `XPathContext` created from it is in use. The standard `Document#xpath`,
41+
`#css`, and related search methods already do this and are unaffected.
42+
43+
### Credit
44+
45+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
46+
cvss_v4: 1.7
47+
patched_versions:
48+
- ">= 1.19.4"
49+
related:
50+
url:
51+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7
52+
- https://github.com/advisories/GHSA-p67v-3w7g-wjg7

‎gems/nokogiri/GHSA-phwj-rprq-35pp.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
gem: nokogiri
3+
ghsa: phwj-rprq-35pp
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp
5+
title: 'Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=`
6+
or `#content=`'
7+
date: 2026-06-19
8+
description: |
9+
### Summary
10+
11+
Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed
12+
memory when replacing the value of an XML attribute. If Ruby code had already
13+
accessed an attribute child node, `Nokogiri::XML::Attr#value=` could free the
14+
underlying native child node while the wrapper remained reachable through the
15+
document node cache. A later use of the freed child node or a Ruby GC mark
16+
could dereference an invalid pointer, causing an invalid read and a possible
17+
segfault.
18+
19+
Nokogiri 1.19.4 preserves any already-wrapped attribute child nodes before
20+
replacing the attribute value.
21+
22+
JRuby is not affected.
23+
24+
### Severity
25+
26+
The Nokogiri maintainers have evaluated this as low severity. Reaching it
27+
requires an unusual API-usage pattern that does not arise during normal use.
28+
The application must directly access an attribute's child node and then
29+
replace that same attribute's value via `Attr#value=` or `#content=`. Nokogiri
30+
1.19.4 makes this pattern safe with no change to the public API.
31+
Already-wrapped attribute child nodes are preserved before the value is
32+
replaced.
33+
34+
### Mitigation
35+
36+
Upgrade to Nokogiri 1.19.4 or later.
37+
38+
As a workaround, avoid accessing attribute child nodes directly via
39+
`Attr#child` or similar before mutating the same attribute’s value.
40+
41+
### Credit
42+
43+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
44+
cvss_v4: 1.7
45+
patched_versions:
46+
- ">= 1.19.4"
47+
related:
48+
url:
49+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp
50+
- https://github.com/advisories/GHSA-phwj-rprq-35pp

‎gems/nokogiri/GHSA-wfpw-mmfh-qq69.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
gem: nokogiri
3+
ghsa: wfpw-mmfh-qq69
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wfpw-mmfh-qq69
5+
title: 'Nokogiri: Possible Use-After-Free in XInclude Processing'
6+
date: 2026-06-19
7+
description: |
8+
### Summary
9+
10+
XInclude substitution performed by `Nokogiri::XML::Node#do_xinclude` replaced
11+
each `<xi:include>` in place, freeing the include node along with its children
12+
(such as `<xi:fallback>` and its descendants) and any namespaces declared on
13+
them. If an application had already exposed one of those nodes or namespaces
14+
to Ruby, the corresponding Ruby object was left pointing at freed memory.
15+
Using the object could result in invalid reads or writes to memory.
16+
17+
Nokogiri 1.19.4 substitutes each `<xi:include>` on a defensive copy by
18+
default, so the structures libxml2 frees are never the ones bound to live Ruby
19+
objects.
20+
21+
Only the CRuby implementation is affected; JRuby is not affected.
22+
23+
### Severity
24+
25+
The Nokogiri maintainers have evaluated this as low severity. Reaching it
26+
requires an unusual API-usage pattern that does not arise during normal use.
27+
The application must parse a document without XInclude, traverse into an
28+
`<xi:include>` subtree to expose its nodes or namespaces to Ruby, and only
29+
then invoke XInclude processing. The common case, requesting XInclude at parse
30+
time, operates on a freshly parsed document whose nodes are not yet exposed to
31+
Ruby and is not affected. Nokogiri 1.19.4 makes this pattern safe by default
32+
and requires no change to application code.
33+
34+
### Mitigation
35+
36+
Upgrade to Nokogiri 1.19.4 or later.
37+
38+
As a workaround for earlier versions, perform XInclude substitution at parse
39+
time (with the `xinclude` parse option) rather than calling `#do_xinclude` on
40+
a document that has already been traversed. A freshly parsed document has no
41+
nodes exposed to Ruby, so the substitution is safe.
42+
43+
### Credit
44+
45+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
46+
patched_versions:
47+
- ">= 1.19.4"
48+
related:
49+
url:
50+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wfpw-mmfh-qq69
51+
- https://github.com/advisories/GHSA-wfpw-mmfh-qq69
52+
notes: "No CVSS score was provided in the GHSA."

0 commit comments

Comments
 (0)