CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

DEBIAN-CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Summary Nokogiri's HTML5 serializer did not escape text inside noscript elements, or inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation...

GHSA-4P39-36WJ-23H4 Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Summary Nokogiri's HTML5 serializer did not escape text inside noscript elements, or inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation...

CVE-2026-126063 Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-126063 Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-126063

The Nokogiri library (versions 1.12.0 to 1.19.5) contains a Mutation XSS vulnerability within its HTML5 serializer on the CRuby and TruffleRuby C extensions. The root cause is that the serializer fails to escape text inside noscript elements or angle brackets within attribute values. If an applic...

CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-126063: sparklemotion nokogiri: Nokogiri is an open source XML and HTML library for the Ruby programming language

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-88060

A flaw was found in @angular/platform-server. Untrusted input in server-side rendered SSR templates, specifically within fallback raw-content elements like noscript or iframe, is not properly escaped. This allows a remote attacker to inject malicious code by crafting input that includes unescaped...

CLEANSTART-2024-AJ67044 DOMParser API did not properly process '<noscript>' elements for escaping

Security vulnerability affects the librewolf package. The DOMParser API did not properly process '' elements for escaping...

CLEANSTART-2024-YU37999 DOMParser API did not properly process '<noscript>' elements for escaping

Security vulnerability affects the firefox package. The DOMParser API did not properly process '' elements for escaping...

Linux Distros Unpatched Vulnerability : CVE-2026-113654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html...

CVE-2026-113654

A flaw was found in sanitize-html. A remote attacker can bypass HTML sanitization by submitting specially crafted markup when the library is configured to strip noscript tags. In this scenario, the parser can prematurely terminate the discard region, allowing unsanitized content to persist and...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via the nonTextTags configuration when noscript is...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the nonTextTags configuration when noscript is included in that set. When htmlparser2 emits an implied ancestor close event inside a noscript element, the discard region ends prematurely, allowing script...

GHSA-X3Q4-9HXX-GX8M ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

Summary sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2's close events, and ignores the isImplied flag htmlparser2 passes it. Closing a still-open ancestor from inside a makes htmlparser2 unwind its stack past the noscript; the synthet...

CVE-2026-113654

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied...

EUVD-2026-105182

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied...

CVE-2026-113654

The sanitize-html library, used in ApostropheCMS , is vulnerable to a logic error in its handling of nonTextTags configurations. Specifically, when noscript is included in a non-default configuration, the discard region can end prematurely because htmlparser2 emits an implied ancestor close. This...