VulnerabilityAnalyzed

CVE-2026-57234

As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks.

LOW 2.6EPSS 0.20%

Does this matter?

Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

CVSS 3.1: 2.6 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS: 0.20% probability · 10th percentile
CISA KEV: Not listed
Weakness: CWE-178, CWE-184, CWE-611
Affected: nokogiri/nokogiri
Source: security-advisories@github.com

References

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.