EUVD-2021-1954

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

Nokogiri v1.12.4 on JRuby exposes users to external entity parsing vulnerability, upgrade needed.

Reporter	Title	Published	Views	Family All 71
AlpineLinux	CVE-2021-41098	27 Sep 202120:15	–	alpinelinux
Circl	CVE-2021-41098	28 Sep 202100:35	–	circl
CNNVD	Nokogiri 代码问题漏洞	27 Sep 202100:00	–	cnnvd
CNVD	Nokogiri Code Issue Vulnerability	29 Sep 202100:00	–	cnvd
CVE	CVE-2021-41098	27 Sep 202119:35	–	cve
Cvelist	CVE-2021-41098 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby	27 Sep 202119:35	–	cvelist
Debian CVE	CVE-2021-41098	27 Sep 202119:35	–	debiancve
Github Security Blog	Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby	27 Sep 202120:12	–	github
NVD	CVE-2021-41098	27 Sep 202120:15	–	nvd
OPENSUSE Linux	ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media (moderate)	26 Jan 202500:00	–	opensuse

[
  {
    "enisaIdVendor": [
      {
        "id": "c380f460-a61e-3402-b684-440297601957",
        "vendor": {
          "name": "sparklemotion"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "4854de99-fb55-368a-b621-a93dc89a3dd3",
        "product": {
          "name": "nokogiri"
        },
        "product_version": "< 1.12.5"
      }
    ]
  }
]

Source	Link
github	www.github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-41098
github	www.github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-41098.yml
github	www.github.com/sparklemotion/nokogiri
suse	www.suse.com/security/cve/CVE-2021-41098.html
security	www.security.archlinux.org/CVE-2021-41098
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

8.5High risk

Vulners AI Score8.5

CVSS 37.5

CVSS 25

CVSS 3.17.5

EPSS0.00251