CVE-2026-126063
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
CVE-2026-126063 is a low vulnerability (CVSS 2.3) in Sparklemotion Nokogiri, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 47th percentile. Fixed in nokogiri 1.19.5.
- Severity
- 2.3 LowCVSS 4.0, CVE List
- Exploit chance
- 0.56%EPSS, 47th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.19.5nokogiri +13 more
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nokogiriRubyGems | 1.12.0 up to 1.19.5 | 1.19.5 |
rubygem-nokogiriAzure Linux:3 | through 1.19.4-1 | None known |
ruby-nokogiriDebian:12 | All versions, plus listed versions 1.13.10+dfsg-21.14.2+dfsg-11.14.3+dfsg-11.14.3+dfsg-21.15.4+dfsg-1 Show 13 moreShow less1.16.0+dfsg-11.16.0+dfsg-21.16.2+dfsg-11.16.4+dfsg-11.17.2+dfsg-1~exp11.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
ruby-nokogiriDebian:13 | All versions, plus listed versions 1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
ruby-nokogiriDebian:14 | All versions, plus listed versions 1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
nokogiriRubyGems | 1.12.0 up to 1.19.5, plus listed versions 1.12.11.12.21.12.31.12.41.12.5 Show 45 moreShow less1.13.01.13.11.13.101.13.21.13.31.13.41.13.51.13.61.13.71.13.81.13.91.14.01.14.0.rc11.14.11.14.21.14.31.14.41.14.51.15.01.15.11.15.21.15.31.15.41.15.51.15.61.15.71.16.01.16.0.rc11.16.11.16.21.16.31.16.41.16.51.16.61.16.71.16.81.17.01.17.11.17.21.18.01.18.0.rc11.18.11.18.101.18.21.18.3 | 1.19.5 |
ruby-nokogiriUbuntu:Pro:14.04:LTS | All versions, plus listed versions 1.5.9-21.5.9-31.6.0-11.6.1+ds-11.6.1+ds-1ubuntu0.1~esm1 | None known |
ruby-nokogiriUbuntu:16.04:LTS | All versions, plus listed versions 1.6.6.2+ds-2build21.6.6.3-11.6.7-11.6.7.1-11.6.7.2-31.6.7.2-3build11.6.7.2-3ubuntu0.1 | None known |
ruby-nokogiriUbuntu:18.04:LTS | All versions, plus listed versions 1.8.0-11.8.1-11.8.1-1build11.8.2-1build11.8.2-1ubuntu0.1 | None known |
ruby-nokogiriUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1.10.3+dfsg1-21.10.4+dfsg1-11.10.7+dfsg1-11.10.7+dfsg1-21.10.7+dfsg1-2build11.10.7+dfsg1-2ubuntu0.1~esm2 | None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby-nokogiriUbuntu:Pro:22.04:LTS | All versions, plus listed versions 1.11.1+dfsg-2ubuntu11.11.7+dfsg-31.11.7+dfsg-3build11.13.1+dfsg-21.13.1+dfsg-2ubuntu0.1~esm1 | None known |
ruby-nokogiriUbuntu:24.04:LTS | All versions, plus listed versions 1.14.3+dfsg-21.16.2+dfsg-11.16.2+dfsg-1build1 | None known |
ruby-nokogiriUbuntu:26.10 | All versions, plus listed versions 1.18.10+dfsg-31.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1 | None known |
ruby-nokogiriUbuntu:26.04:LTS | All versions, plus listed versions 1.18.2+dfsg-1build11.18.10+dfsg-21.18.10+dfsg-3 | None known |
What each source reports
CVE List Score used
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126063- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-10
EUVDEUVD-2026-122832
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
- Record
EUVD-2026-122832- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-10
GitHub AdvisoriesGHSA-4p39-36wj-23h4
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
Summary
Nokogiri's HTML5 serializer did not escape text inside noscript elements, or < and > inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.
Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parse_noscript_content_as_text: true.
Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5.
Severity
The Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). Exploitation requires an application that allows noscript in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.
Mitigation
Upgrade to Nokogiri 1.19.5 or later.
Applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true (available since Nokogiri 1.17.0), or remove noscript elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside noscript is serialized unchanged, as the standard requires.
Credit
This issue was responsibly reported by @a-zara-n.
- Record
GHSA-4p39-36wj-23h4- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-10
NVD
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126063- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-11
OSV
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126063- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-116, CWE-79
- Updated
- 2026-11-12
OSVDEBIAN-CVE-2026-126063
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
- Record
DEBIAN-CVE-2026-126063- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-11
OSVGHSA-4p39-36wj-23h4
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
Summary
Nokogiri's HTML5 serializer did not escape text inside noscript elements, or < and > inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.
Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parse_noscript_content_as_text: true.
Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5.
Severity
The Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). Exploitation requires an application that allows noscript in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.
Mitigation
Upgrade to Nokogiri 1.19.5 or later.
Applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true (available since Nokogiri 1.17.0), or remove noscript elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside noscript is serialized unchanged, as the standard requires.
Credit
This issue was responsibly reported by @a-zara-n.
- Record
GHSA-4p39-36wj-23h4- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-116, CWE-79
- Updated
- 2026-11-10
OSVUBUNTU-CVE-2026-126063
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
- Record
UBUNTU-CVE-2026-126063- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-13
OSVAZL-113627No score
CVE-2026-126063 affecting package rubygem-nokogiri 1.19.4-1
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
- Record
AZL-113627- Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| published | EUVD | |
| published | EUVD | |
| description, references, severity | CVE List | |
| aliases, products, published, references | EUVD | |
| affected, references | OSV | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-126063
security-tracker.debian.org/tracker/CVE-2026-126063
ubuntu.com/security/CVE-2026-126063
cve.org/CVERecord?id=CVE-2026-126063
Left out here: 11 versions. The JSON record has them.