Skip to contentSparklemotion Nokogiri vulnerabilities
- sparklemotion nokogiriNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`CVE-2026-126064Fix available2.0 Low
- sparklemotion nokogiriNokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializerCVE-2026-126063Fix available2.3 Low
- sparklemotion nokogiriNokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` setCVE-2026-126062Fix available3.7 Low
- sparklemotion nokogiriNokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_argsCVE-2026-79769Fix available8.7 High
- nokogiriNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`CVE-2026-57435Fix available1.7 Low
- nokogiriNokogiri: Possible Use-After-Free in XInclude ProcessingCVE-2026-57438Fix available2.2 Low
- nokogiriNokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimeCVE-2026-57437Fix available1.7 Low
- nokogiriNokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node typeCVE-2026-57436Fix available1.7 Low
- nokogiriNokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`CVE-2026-57235Fix available6.3 Medium
- nokogiriNokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classesCVE-2026-57434Fix available1.7 Low
- nokogiriNokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247CVE-2026-57234Fix available2.6 Low
- nokogiriNokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exceptionCVE-2026-57236Fix available1.7 Low
- nokogiriNokogiri before 1.19.3 Memory Leak via XSLT TransformCVE-2026-79771Fix available6.9 Medium
- nokogiriNokogiri before 1.19.3 ReDoS via CSS selector tokenizerCVE-2026-79770Fix available8.7 High
- nokogiriNokogiri before 1.19.1 Unchecked Return Value canonicalizeCVE-2026-79772Fix available6.9 Medium
- sparklemotion nokogirisparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflowCVE-2025-6494Disputed4.8 Medium
- sparklemotion nokogirisparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflowCVE-2025-6490Disputed4.8 Medium
- nokogiriUnchecked return value from xmlTextReaderExpand in NokogiriCVE-2022-23476Fix available7.5 High
- nokogiri, apple macos +1 moreImproper Handling of Unexpected Data Type in NokogiriCVE-2022-29181Fix available8.2 High
- nokogiri, apple macos, debian linux +1 more +3 moreInefficient Regular Expression Complexity in NokogiriCVE-2022-24836Fix available7.5 High
- nokogiriImproper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyCVE-2021-41098Fix available7.5 High
- nokogiri, debian linux +1 moreXXE in NokogiriCVE-2020-26247Fix available2.6 Low