Skip to content

Commit d8cdc56

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@352c185 
1 parent e31a4d3 commit d8cdc56

8 files changed

Lines changed: 468 additions & 0 deletions

‎advisories/_posts/2026-06-19-GHSA-5prr-v3j2-97mh.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-5prr-v3j2-97mh (nokogiri): Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`'
4+
comments: false
5+
categories:
6+
- nokogiri
7+
advisory:
8+
gem: nokogiri
9+
ghsa: 5prr-v3j2-97mh
10+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5prr-v3j2-97mh
11+
title: 'Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`'
12+
date: 2026-06-19
13+
description: |-
14+
### Summary
15+
16+
`Nokogiri::XML::NodeSet#[]` (and its alias `#slice`) checked the requested
17+
index against the node set's bounds using a 32-bit-truncated copy of the
18+
index. A large negative index could pass the check and then be used at full
19+
width, reading outside the node set's storage. On CRuby this is an
20+
out-of-bounds read that typically crashes the process; on JRuby it is not
21+
memory-unsafe but returns an incorrect node.
22+
23+
Nokogiri 1.19.4 performs the bounds check against the full-width index.
24+
25+
### Severity
26+
27+
The Nokogiri maintainers have evaluated this as medium severity.
28+
29+
Exploitation requires an application to pass an attacker-controlled integer to
30+
`NodeSet#[]`. The primary impact is a controlled crash (denial of service),
31+
with potential for memory disclosure on CRuby.
32+
33+
On JRuby, Nokogiri is not affected by this vulnerability.
34+
35+
### Mitigation
36+
37+
Upgrade to Nokogiri 1.19.4 or later.
38+
39+
As a workaround, applications that index a `NodeSet` with externally-supplied
40+
integers can validate the index against `node_set.length` before use, or avoid
41+
passing untrusted values as an index.
42+
43+
### Credit
44+
45+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
46+
cvss_v4: 6.3
47+
patched_versions:
48+
- ">= 1.19.4"
49+
related:
50+
url:
51+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5prr-v3j2-97mh
52+
- https://github.com/advisories/GHSA-5prr-v3j2-97mh
53+
---

‎advisories/_posts/2026-06-19-GHSA-5v8h-3h3q-446p.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-5v8h-3h3q-446p (nokogiri): Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=`
4+
raises an exception'
5+
comments: false
6+
categories:
7+
- nokogiri
8+
advisory:
9+
gem: nokogiri
10+
ghsa: 5v8h-3h3q-446p
11+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p
12+
title: 'Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=`
13+
raises an exception'
14+
date: 2026-06-19
15+
description: |-
16+
### Summary
17+
18+
Calling `Document#encoding=` with an invalid encoding (e.g., a non-string, or
19+
a string containing a null byte) raises an exception, but only after freeing
20+
the document's current encoding string without replacing it. The document is
21+
left referencing freed memory, so the next call to `Document#encoding` reads
22+
invalid memory, which can cause a segfault or leak freed bytes into a Ruby
23+
`String`.
24+
25+
Affects the CRuby (libxml2) implementation only; JRuby is not affected.
26+
27+
### Severity
28+
29+
The Nokogiri maintainers have evaluated this as low severity. Reaching it
30+
requires an unusual API-usage pattern that does not arise during normal use.
31+
The application must pass an invalid encoding to `Document#encoding=`, rescue
32+
the resulting exception, and then continue using the same document. Nokogiri
33+
1.19.4 makes this pattern safe with no change to the public API. The document
34+
no longer references freed memory after the exception is raised.
35+
36+
### Mitigation
37+
38+
Upgrade to Nokogiri 1.19.4 or later.
39+
40+
If users are unable to upgrade, avoid passing attacker-controlled values to
41+
`Document#encoding=`. Applications that only assign developer-authored
42+
encodings are not directly exposed.
43+
44+
### Credit
45+
46+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
47+
cvss_v4: 1.7
48+
patched_versions:
49+
- ">= 1.19.4"
50+
related:
51+
url:
52+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p
53+
- https://github.com/advisories/GHSA-5v8h-3h3q-446p
54+
---

‎advisories/_posts/2026-06-19-GHSA-8678-w3jw-xfc2.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-8678-w3jw-xfc2 (nokogiri): Nokogiri: XML::Schema on JRuby allows network
4+
requests when NONET is set, bypassing CVE-2020-26247'
5+
comments: false
6+
categories:
7+
- nokogiri
8+
advisory:
9+
gem: nokogiri
10+
ghsa: 8678-w3jw-xfc2
11+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2
12+
title: 'Nokogiri: XML::Schema on JRuby allows network requests when NONET is set,
13+
bypassing CVE-2020-26247'
14+
date: 2026-06-19
15+
description: |-
16+
### Summary
17+
18+
The `NONET` parse option, which Nokogiri turns on by default for
19+
`Nokogiri::XML::Schema` (see
20+
[CVE-2020-26247](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m)),
21+
was not correctly enforced on the JRuby implementation. As a result, a schema
22+
parsed with default options could still cause external resources to be fetched
23+
over the network, potentially enabling SSRF or XXE attacks.
24+
25+
Nokogiri 1.19.4 replaces the scheme denylist with an allowlist. When `NONET`
26+
is enabled, only local resources (a `file:` scheme, or a relative or absolute
27+
path with no scheme) are resolved, and every network scheme is blocked,
28+
case-insensitively. This brings the JRuby behavior in line with CRuby.
29+
30+
Only the JRuby implementation is affected. CRuby is not affected, because
31+
libxml2's `xmlNoNetExternalEntityLoader` blocks all network schemes at the I/O
32+
layer regardless of scheme or case.
33+
34+
### Severity
35+
36+
The Nokogiri maintainers have evaluated this as low severity (CVSS 2.6,
37+
`CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N`). It is a bypass of
38+
CVE-2020-26247, which was scored the same way.
39+
40+
### Mitigation
41+
42+
Upgrade to Nokogiri 1.19.4 or later.
43+
44+
There are no known workarounds for affected versions.
45+
46+
This change properly enforces `NONET` on JRuby, which is a breaking change for
47+
any code that (perhaps unknowingly) relied on the previous behavior to load
48+
network resources with default parse options. If you trust your input and want
49+
to allow external resources to be accessed over the network, you can
50+
explicitly disable `NONET`, exactly as documented for CVE-2020-26247:
51+
52+
1. Ensure the input is trusted. Do not enable this option for untrusted input.
53+
2. Pass a `Nokogiri::XML::ParseOptions` with the `NONET` flag turned off:
54+
55+
``` ruby
56+
# allows resources to be accessed over the network for trusted input
57+
schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)
58+
```
59+
60+
### References
61+
62+
- Bypass of: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m
63+
64+
### Credit
65+
66+
This issue was responsibly reported by @bilerden.
67+
cvss_v3: 2.6
68+
patched_versions:
69+
- ">= 1.19.4"
70+
related:
71+
url:
72+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2
73+
- https://github.com/advisories/GHSA-8678-w3jw-xfc2
74+
---

‎advisories/_posts/2026-06-19-GHSA-9cv2-cfxc-v4v2.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-9cv2-cfxc-v4v2 (nokogiri): Nokogiri: Null Pointer Dereference calling
4+
methods on uninitialized wrapper classes'
5+
comments: false
6+
categories:
7+
- nokogiri
8+
advisory:
9+
gem: nokogiri
10+
ghsa: 9cv2-cfxc-v4v2
11+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2
12+
title: 'Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper
13+
classes'
14+
date: 2026-06-19
15+
description: |-
16+
### Summary
17+
18+
Nokogiri contains a bug when calling certain methods on
19+
allocated-but-uninitialized native wrapper classes that inherit from
20+
`Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash
21+
the process.
22+
23+
Nokogiri 1.19.4 checks for missing native data pointers and raises a
24+
`RuntimeError`.
25+
26+
JRuby is not affected.
27+
28+
### Severity
29+
30+
The Nokogiri maintainers have evaluated this as low severity. This is only
31+
triggered by a programming error. It requires application code to call
32+
`.allocate` directly on a native-backed class and then invoke methods on the
33+
resulting uninitialized object. It cannot be triggered by untrusted input or
34+
through normal use of the public API.
35+
36+
### Mitigation
37+
38+
Upgrade to Nokogiri 1.19.4 or later.
39+
40+
Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the
41+
documented constructors and factory methods instead.
42+
43+
### Credit
44+
45+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
46+
cvss_v4: 1.7
47+
patched_versions:
48+
- ">= 1.19.4"
49+
related:
50+
url:
51+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2
52+
- https://github.com/advisories/GHSA-9cv2-cfxc-v4v2
53+
---

‎advisories/_posts/2026-06-19-GHSA-p67v-3w7g-wjg7.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-p67v-3w7g-wjg7 (nokogiri): Nokogiri: Possible Use-After-Free when directly
4+
using `NokogirI::XML::XPathContext` beyond document lifetime'
5+
comments: false
6+
categories:
7+
- nokogiri
8+
advisory:
9+
gem: nokogiri
10+
ghsa: p67v-3w7g-wjg7
11+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7
12+
title: 'Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext`
13+
beyond document lifetime'
14+
date: 2026-06-19
15+
description: |-
16+
### Summary
17+
18+
`Nokogiri::XML::XPathContext` did not keep its source document alive for
19+
garbage collection. If an `XPathContext` outlived its document and the
20+
document was collected, evaluating an XPath expression could read invalid
21+
memory and potentially segfault.
22+
23+
This is only reachable when application code constructs an `XPathContext`
24+
directly and lets the document become unreachable while continuing to use the
25+
context. The normal `Document#xpath`, `#css`, and related search methods are
26+
not affected, and it is not triggerable by malicious document input.
27+
28+
Nokogiri 1.19.4 makes `XPathContext` keep its source document alive for as
29+
long as the context exists.
30+
31+
Only the CRuby implementation is affected. JRuby is not affected.
32+
33+
### Severity
34+
35+
The Nokogiri maintainers have evaluated this as low severity. Reaching it
36+
requires an unusual API-usage pattern that does not arise during normal use.
37+
The application must construct an `XML::XPathContext` directly and continue
38+
using it after allowing its source document to be garbage-collected. Nokogiri
39+
1.19.4 makes this pattern safe with no change to the public API. The context
40+
now keeps its source document alive for as long as it exists.
41+
42+
### Mitigation
43+
44+
Upgrade to Nokogiri 1.19.4 or later.
45+
46+
As a workaround, ensure the source document remains referenced for as long as
47+
any `XPathContext` created from it is in use. The standard `Document#xpath`,
48+
`#css`, and related search methods already do this and are unaffected.
49+
50+
### Credit
51+
52+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
53+
cvss_v4: 1.7
54+
patched_versions:
55+
- ">= 1.19.4"
56+
related:
57+
url:
58+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7
59+
- https://github.com/advisories/GHSA-p67v-3w7g-wjg7
60+
---

‎advisories/_posts/2026-06-19-GHSA-phwj-rprq-35pp.md‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-phwj-rprq-35pp (nokogiri): Nokogiri: Possible Use-After-Free when setting
4+
an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`'
5+
comments: false
6+
categories:
7+
- nokogiri
8+
advisory:
9+
gem: nokogiri
10+
ghsa: phwj-rprq-35pp
11+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp
12+
title: 'Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=`
13+
or `#content=`'
14+
date: 2026-06-19
15+
description: |-
16+
### Summary
17+
18+
Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed
19+
memory when replacing the value of an XML attribute. If Ruby code had already
20+
accessed an attribute child node, `Nokogiri::XML::Attr#value=` could free the
21+
underlying native child node while the wrapper remained reachable through the
22+
document node cache. A later use of the freed child node or a Ruby GC mark
23+
could dereference an invalid pointer, causing an invalid read and a possible
24+
segfault.
25+
26+
Nokogiri 1.19.4 preserves any already-wrapped attribute child nodes before
27+
replacing the attribute value.
28+
29+
JRuby is not affected.
30+
31+
### Severity
32+
33+
The Nokogiri maintainers have evaluated this as low severity. Reaching it
34+
requires an unusual API-usage pattern that does not arise during normal use.
35+
The application must directly access an attribute's child node and then
36+
replace that same attribute's value via `Attr#value=` or `#content=`. Nokogiri
37+
1.19.4 makes this pattern safe with no change to the public API.
38+
Already-wrapped attribute child nodes are preserved before the value is
39+
replaced.
40+
41+
### Mitigation
42+
43+
Upgrade to Nokogiri 1.19.4 or later.
44+
45+
As a workaround, avoid accessing attribute child nodes directly via
46+
`Attr#child` or similar before mutating the same attribute’s value.
47+
48+
### Credit
49+
50+
This issue was responsibly reported by Zheng Yu from depthfirst.com.
51+
cvss_v4: 1.7
52+
patched_versions:
53+
- ">= 1.19.4"
54+
related:
55+
url:
56+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp
57+
- https://github.com/advisories/GHSA-phwj-rprq-35pp
58+
---

0 commit comments

Comments
 (0)