CVE-2026-57234

EUVD-2026-39421

25.06.2026, 15:16

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	2.6 LOW	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 6.24%

Affected Products (NVD)

Vendor	Product	Version
nokogiri	nokogiri	𝑥 < 1.19.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ruby-nokogiri

bookworm	unimportant
bullseye	unimportant
bullseye (security)	unimportant
forky	1.19.4+dfsg-1 fixed
sid	1.19.4+dfsg-1 fixed
trixie	unimportant

Ubuntu Releases

Ubuntu Product

Codename

ruby-nokogiri

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
trusty	needs-triage

Azure Linux Releases

Azure Package

Release

rubygem-nokogiri

Azure Linux 3.0

0:1.19.4-1.azl3

fixed

Common Weakness Enumeration

CWE-178 - Improper Handling of Case Sensitivity
The software does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

References

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2