CVE-2020-26247

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with
XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there
is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are
trusted by default, allowing external resources to be accessed over the
network, potentially enabling XXE or SSRF attacks. This behavior is counter
to the security policy followed by Nokogiri maintainers, which is to treat
all input as untrusted by default whenever possible. This is fixed in
Nokogiri version 1.11.0.rc4.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978967&gt;