CVE-2026-57234

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

CVSS v3 2.6 LOW

2.6^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Nokogiri es una biblioteca de código abierto de XML y HTML para el lenguaje de programación Ruby. Antes de la versión 1.19.4, la opción de análisis NONET, que Nokogiri activa por defecto para Nokogiri::XML::Schema (ver CVE-2020-26247), no se aplicaba correctamente en la implementación de JRuby. Como resultado, un esquema analizado con las opciones por defecto aún podía provocar que se obtuvieran recursos externos a través de la red, lo que potencialmente permitía ataques SSRF o XXE. Esta vulnerabilidad se corrigió en la versión 1.19.4.

Information

Published : 2026-06-25 15:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-57234

Mitre link : CVE-2026-57234

CVE.ORG link : CVE-2026-57234

JSON object : View

Products Affected

nokogiri

nokogiri

CWE

CWE-178

Improper Handling of Case Sensitivity

CWE-184

Incomplete List of Disallowed Inputs

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-57234", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57234", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T15:05:35.927298Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.6, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sparklemotion", "product": "nokogiri", "versions": [{"status": "affected", "version": "< 1.19.4"}]}]}], "published": "2026-06-25T15:16:40.343", "references": [{"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-178"}, {"lang": "en", "value": "CWE-184"}, {"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4."}, {"lang": "es", "value": "Nokogiri es una biblioteca de c\u00f3digo abierto de XML y HTML para el lenguaje de programaci\u00f3n Ruby. Antes de la versi\u00f3n 1.19.4, la opci\u00f3n de an\u00e1lisis NONET, que Nokogiri activa por defecto para Nokogiri::XML::Schema (ver CVE-2020-26247), no se aplicaba correctamente en la implementaci\u00f3n de JRuby. Como resultado, un esquema analizado con las opciones por defecto a\u00fan pod\u00eda provocar que se obtuvieran recursos externos a trav\u00e9s de la red, lo que potencialmente permit\u00eda ataques SSRF o XXE. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.19.4."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "1E436D65-41E3-459F-9D7F-3CD5BB2BFCB1", "versionEndExcluding": "1.19.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}