CVE-2021-41098

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with
XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby
only, the SAX parser resolves external entities by default. Users of
Nokogiri on JRuby who parse untrusted documents using any of these classes
are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or
its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and
Nokogiri::HTML4::SAX::PushParser or its alias
Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri
v1.12.5 or later to receive a patch for this issue. There are no
workarounds available for v1.12.4 or earlier. CRuby users are not affected.