CVE-2021-41098
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
- Record
CVE-2021-41098- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2021-1954
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
- Record
EUVD-2021-1954- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2rr5-8q37-2w7h
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Severity
The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.0) for JRuby users. (This security advisory does not apply to CRuby users.)
Impact
In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default.
Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:
- Nokogiri::XML::SAX::Parser
- Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
- Nokogiri::XML::SAX::PushParser
- Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser
Mitigation
JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.
CRuby users are not affected.
- Record
GHSA-2rr5-8q37-2w7h- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
- Record
CVE-2021-41098- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
- Record
CVE-2021-41098- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-2rr5-8q37-2w7h
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Severity
The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.0) for JRuby users. (This security advisory does not apply to CRuby users.)
Impact
In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default.
Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:
- Nokogiri::XML::SAX::Parser
- Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
- Nokogiri::XML::SAX::PushParser
- Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser
Mitigation
JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.
CRuby users are not affected.
- Record
GHSA-2rr5-8q37-2w7h- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
Show 7 moreShow less
OSVOESA-2021-1396
rubygem-nokogiri security update
Nokogiri parses and searches XML/HTML very quickly, and also has correctly implemented CSS3 selector support as well as XPath support. Nokogiri also features an Hpricot compatibility layer to help ease the change to using correct CSS and XPath. %if 0
Security Fix(es):
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.(CVE-2021-41098)
- Record
OESA-2021-1396- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11577-1 No score
ruby2.7-rubygem-nokogiri-1.12.5-1.1 on GA media
These are all security issues fixed in the ruby2.7-rubygem-nokogiri-1.12.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11577-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11912-1 No score
ruby3.1-rubygem-nokogiri-1.13.3-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11912-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13165-1 No score
ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media
These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13165-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14174-1 No score
ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14174-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14697-1 No score
ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14697-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10356-1 No score
ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media
These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10356-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nokogiriRubyGems |
through 1.12.4 | 1.12.5 |
nokogiriRubyGems |
before 1.12.5, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.0.51.0.61.0.71.1.01.1.11.10.01.10.0.rc11.10.11.10.101.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0.rc11.11.0.rc21.11.0.rc31.11.0.rc41.11.11.11.21.11.31.11.41.11.51.11.61.11.71.12.01.12.0.rc11.12.11.12.21.12.31.12.41.2.01.2.11.2.21.2.31.3.01.3.11.3.21.3.31.4.01.4.1 |
1.12.5 |
rubygem-nokogiriopenEuler:20.03-LTS-SP1 |
before 1.10.5-3.oe1 | 1.10.5-3.oe1 |
rubygem-nokogiriopenEuler:20.03-LTS-SP2 |
before 1.10.5-3.oe1 | 1.10.5-3.oe1 |
rubygem-nokogiriopenSUSE:Tumbleweed |
before 1.12.5-1.1 | 1.12.5-1.1 |
rubygem-nokogiriopenSUSE:Tumbleweed From an advisory covering 35 CVEs |
before 1.13.3-1.1 | 1.13.3-1.1 |
ruby3.2-rubygem-nokogiriopenSUSE:Tumbleweed From an advisory covering 41 CVEs |
before 1.13.9-1.7 | 1.13.9-1.7 |
rubygem-nokogiriopenSUSE:Tumbleweed From an advisory covering 44 CVEs |
before 1.15.5-1.5 | 1.15.5-1.5 |
rubygem-nokogiriopenSUSE:Tumbleweed From an advisory covering 44 CVEs |
before 1.18.2-1.1 | 1.18.2-1.1 |
rubygem-nokogiriopenSUSE:Tumbleweed From an advisory covering 44 CVEs |
before 1.18.9-1.4 | 1.18.9-1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41098 is a high vulnerability (CVSS 7.5) in Nokogiri, published September 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. Fixed in nokogiri 1.12.5.
References
github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h
nvd.nist.gov/vuln/detail/CVE-2021-41098
Show 46 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1396
suse.com/security/cve/CVE-2021-41098
lists.opensuse.org/archives/list/[email protected]/thread/U5YNW74OL2W7SH2XTAVN5TODNFIVFL3Y
Left out here: 88 versions. The JSON record has them.