CVE-2026-126062

The Nokogiri XML and HTML library for Ruby contains a vulnerability affecting versions prior to 1.19.5 when running on JRuby . When parsing untrusted XML with DTDLOAD, DTDVALID, or NOENT options, the NONET restriction can be bypassed if an external DTD or entity uses a short-form IPv4 host or abs...

XML External Entity (XXE) Injection

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the NokogiriEntityResolver in JRuby’s XML entity-resolution component. An attacker can trigger network requests despite NONET by supplying...

XML External Entity (XXE) Via Libxml2

nokogiri is using libxml2 library which is vulnerable to the CVE-2016-9318. The vulnerability is only possible when applications using nokogiri 1.5.4 and later do not opt into the DTDLOAD option and opt out of the NONET option. The default setting in nokogiri does not use both DTD loading and...