sanitize

Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...

Astra Linux – Vulnerability in Ruby-Nokogiri

Nokogiri is an open-source XML and HTML library for Ruby. Nokogiri contains a regular expression that is inefficient and prone to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri = 1.13.4. There are no known solutions or...

[SECURITY] Fedora 45 Update: rubygem-nokogiri-1.19.4-5.fc45

Nokogiri parses and searches XML/HTML very quickly, and also has correctly implemented CSS3 selector support as well as XPath support. Nokogiri also features an Hpricot compatibility layer to help ease the change to using correct CSS and XPath...

Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228506 advisory. netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 netty-codec: SnappyFrameDecoder doesn't restrict chu...

Astra Linux – Vulnerability in Ruby-Nokogiri

Nokogiri is a Rubygem that provides HTML, XML, SAX, and Reader parsers, with support for XPath and CSS selectors. In Nokogiri versions prior to 1.11.0.rc4, there was an XXE vulnerability. XML schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accesse...

Astra Linux – Vulnerability in Ruby-Nokogiri

A command injection vulnerability exists in Nokogiri v1.10.3 and earlier. This vulnerability allows commands to be executed in a subprocess via Ruby’s Kernel.open method. Processes become vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is called with unsafe user input ...

CVE-2024-58377

Rejected CVE Nokogiri before 1.16.5, when using bundled libxml2, is affected by the libxml2 flaw CVE-2024-34459...

CVE-2024-58378

Nokogiri before 1.15.6 and 1.16.x before 1.16.2, when using bundled libxml2, is affected by the libxml2 flaw CVE-2024-25062. Mitigation Upgrade Nokogiri to 1.15.6 or to 1.16.2 or later. If upgrading is not possible, compile and link Nokogiri against patched external libxml2 libraries. Installatio...

CVE-2022-51000

Nokogiri before 1.13.2, when using bundled libxml2 and libxslt, is affected by the libxslt flaw CVE-2021-30560 and the libxml2 flaw CVE-2022-23308...

CVE-2025-71407

Nokogiri before 1.18.3, when using bundled libxml2, is affected by the libxml2 flaws CVE-2025-24928 and CVE-2024-56171. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and...

Linux Distros Unpatched Vulnerability : CVE-2025-71346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the...

Linux Distros Unpatched Vulnerability : CVE-2024-58377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxm...

Linux Distros Unpatched Vulnerability : CVE-2025-71406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.18.4 bundles a vulnerable version of libxslt prior to 1.1.43 that contains two use- after-free vulnerabilities: CVE-2025-24855 use-after-free ...

Linux Distros Unpatched Vulnerability : CVE-2022-50998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.13.9 CRuby implementation using packaged libraries bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 data corruption / double-free...

Linux Distros Unpatched Vulnerability : CVE-2023-54354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in X...

Linux Distros Unpatched Vulnerability : CVE-2024-58378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 i...

Linux Distros Unpatched Vulnerability : CVE-2021-47996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.11.4 CRuby implementation only, when the packaged/vendored libxml2 is used bundles libxml2 2.9.10, which is affected by multiple vulnerabiliti...

Linux Distros Unpatched Vulnerability : CVE-2025-71407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a...

Linux Distros Unpatched Vulnerability : CVE-2022-51000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.13.2 CRuby, when using packaged libraries ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via...

Linux Distros Unpatched Vulnerability : CVE-2022-50999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause...