CVE-2026-126079

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using loaddefaults 7.1 or later, Nokogiri before...

EUVD-2026-122828

JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host...

EUVD-2026-122836

Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value...

EUVD-2026-122832

Nokogiri: Mutation XSS through noscript content in Nokogiri's HTML5 serializer...

CVE-2026-126064 Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node= or Nokogiri::XML::Nodelang= replaces an existing attribute value after code has accessed the...

CVE-2026-126064

The Nokogiri library for the Ruby programming language contains a Use-After-Free vulnerability in its CRuby native extension prior to version 1.19.5 . The issue occurs when using Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= to replace an existing attribute value after the code has already...

CVE-2026-126063

The Nokogiri library (versions 1.12.0 to 1.19.5) contains a Mutation XSS vulnerability within its HTML5 serializer on the CRuby and TruffleRuby C extensions. The root cause is that the serializer fails to escape text inside noscript elements or angle brackets within attribute values. If an applic...

CVE-2026-126062

The Nokogiri XML and HTML library for Ruby contains a vulnerability affecting versions prior to 1.19.5 when running on JRuby . When parsing untrusted XML with DTDLOAD, DTDVALID, or NOENT options, the NONET restriction can be bypassed if an external DTD or entity uses a short-form IPv4 host or abs...

XML External Entity (XXE) Injection

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the NokogiriEntityResolver in JRuby’s XML entity-resolution component. An attacker can trigger network requests despite NONET by supplying...

sanitize

Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...

CLEANSTART-2025-BG58382 command injection vulnerability in Nokogiri v1

Security vulnerability affects the ruby-nokogiri package. A command injection vulnerability in Nokogiri v1...

CLEANSTART-2025-VQ56739 Nokogiri is an open source XML and HTML library for Ruby

Security vulnerability affects the ruby-nokogiri package. Nokogiri is an open source XML and HTML library for Ruby...

CLEANSTART-2025-XO41567 Nokogiri is an open source XML and HTML library for Ruby

Security vulnerability affects the ruby-nokogiri package. Nokogiri is an open source XML and HTML library for Ruby...

CLEANSTART-2025-OG20837 Nokogiri is an open source XML and HTML library for the Ruby programming language

Security vulnerability affects the ruby-nokogiri package. Nokogiri is an open source XML and HTML library for the Ruby programming language...

Astra Linux – vulnerability in ruby-nokogiri

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue...

Astra Linux – vulnerability in ruby-nokogiri

Nokogiri is a Ruby gem that provides HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri versions prior to 1.11.0.rc4, there is an XXE vulnerability. XML schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over...

Important Photon OS Security Update - PHSA-2026-5.0-90-1031

Updates of 'rubygem-nokogiri' packages of Photon OS have been released...

[SECURITY] Fedora 45 Update: rubygem-nokogiri-1.19.4-5.fc45

Nokogiri parses and searches XML/HTML very quickly, and also has correctly implemented CSS3 selector support as well as XPath support. Nokogiri also features an Hpricot compatibility layer to help ease the change to using correct CSS and XPath...

Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228506 advisory. netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 netty-codec: SnappyFrameDecoder doesn't restrict chu...

Astra Linux – Vulnerability in Ruby-Nokogiri

A command injection vulnerability exists in Nokogiri v1.10.3 and earlier. This vulnerability allows commands to be executed in a subprocess via Ruby’s Kernel.open method. Processes become vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is called with unsafe user input ...