Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 23

Export CSV
CVE-2026-126062

Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Nokogiri
CVE-2026-126063

Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Nokogiri
CVE-2026-126064

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Nokogiri
CVE-2026-107399

Mechanize sends credential headers to another origin after a meta refresh

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Mechanize
CVE-2026-107714

Mechanize sends credential headers to a different scheme or port after a redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Mechanize
CVE-2026-107715

Mechanize sends credential headers to another host after an HTTP redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Mechanize
CVE-2025-71346

nokogiri: libxml2: Nokogiri: Heap buffer under-read in XML Schema validation

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 2.9 Low EPSS n/a KEV · Not listed
Vendors
Sparklemotion
Products
Nokogiri
CVE-2026-79771

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nokogiri Sparklemotion
Products
Nokogiri Nokogiri
CVE-2026-79772

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nokogiri Sparklemotion
Products
Nokogiri Nokogiri
CVE-2026-54619

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Sqlite3-ruby
CVE-2026-54620

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Sqlite3-ruby
CVE-2026-57236

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Nokogiri Sparklemotion
Products
Nokogiri Nokogiri
CVE-2026-57234

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Nokogiri Sparklemotion
Products
Nokogiri Nokogiri
CVE-2026-57235

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nokogiri Sparklemotion
Products
Nokogiri Nokogiri
CVE-2026-57434

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Nokogiri Sparklemotion
Products
Nokogiri Nokogiri
CVE-2026-57435

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Nokogiri Sparklemotion
Products
Nokogiri Nokogiri