TI-2022-11724 CVE-2022-29181 · GHSA-xh29-r2w5-wx8m
Improper Handling of Unexpected Data Type in Nokogiri
Priority HIGH 75
Nokogiri is an open source XML and HTML library for Ruby.
sparklemotion
Records32All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9
Exploited now
sparklemotion records in CISA KEVNo sparklemotion vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
32 records
TI-2018-15259 CVE-2018-25032 · GHSA-jc36-42cf-vqwj
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if…
Priority HIGH 72
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
TI-2026-69678 CVE-2026-107715 · GHSA-2mwr-xjcg-37j7
Mechanize leaks credential headers to other hosts after redirects
Priority MEDIUM 63
The Mechanize library is used for automating interaction with websites.
TI-2025-05895 CVE-2025-6494
sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow
Priority MEDIUM 55
A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833.
TI-2025-05891 CVE-2025-6490
sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow
Priority MEDIUM 55
A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic.
TI-2019-03885 CVE-2019-5477 · GHSA-cr5j-953j-xw5p
OS command injection in Nokogiri
Priority MEDIUM 51
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method.
TI-2026-55247 CVE-2026-79770 · GHSA-c4rq-3m3g-8wgx
Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
Priority MEDIUM 44
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization.
TI-2026-55246 CVE-2026-79769 · GHSA-58vh-2xxg-v7j2
Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args
Priority MEDIUM 43
Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an…
TI-2022-08651 CVE-2022-24839 · GHSA-9849-p7jc-9rmv
Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
Priority MEDIUM 43
org.cyberneko.html is an html parser written in Java.
TI-2022-07536 CVE-2022-23476 · GHSA-qv4q-mr5r-qprj
Unchecked return value from xmlTextReaderExpand in Nokogiri
Priority MEDIUM 42
Nokogiri is an open source XML and HTML library for the Ruby programming language.
TI-2021-04389 CVE-2021-21289 · GHSA-qrqm-fpv6-6r8g
Command Injection Vulnerability in Mechanize
Priority MEDIUM 42
Mechanize is an open-source ruby library that makes automated web interaction easy.
TI-2022-08648 CVE-2022-24836 · GHSA-crjr-9rc5-ghw8
Inefficient Regular Expression Complexity in Nokogiri
Priority LOW 39
Nokogiri is an open source XML and HTML library for Ruby.
TI-2026-55248 CVE-2026-79771 · GHSA-v2fc-qm4h-8hqv
Nokogiri before 1.19.3 Memory Leak via XSLT Transform
Priority LOW 37
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes.
TI-2012-05390 CVE-2012-6685 · GHSA-6wj9-77wq-jq7p
Nokogiri before 1.5.4 is vulnerable to XXE attacks
Priority LOW 37
Nokogiri before 1.5.4 is vulnerable to XXE attacks
TI-2026-55249 CVE-2026-79772 · GHSA-wx95-c6cv-8532
Nokogiri before 1.19.1 Unchecked Return Value canonicalize
Priority LOW 36
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception.
TI-2022-13078 CVE-2022-31033 · GHSA-64qm-hrgp-pgr9
Authorization header leak in rubygem Mechanize
Priority LOW 36
The Mechanize library is used for automating interaction with websites.
TI-2021-17940 CVE-2021-41098 · GHSA-2rr5-8q37-2w7h
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Priority LOW 36
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support.
TI-2013-05414 CVE-2013-6461 · GHSA-jmhh-w7xp-wg39
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
Priority LOW 33
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
TI-2013-05413 CVE-2013-6460 · GHSA-62qp-3fxm-9wxf
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
Priority LOW 33
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
TI-2026-69691 CVE-2026-107399 · GHSA-c6rp-p8xm-4q9f
Mechanize leaks configured headers to other origins on meta refresh
Priority LOW 30
The Mechanize library is used for automating interaction with websites.
Priority LOW 28
Nokogiri is an open source XML and HTML library for the Ruby programming language.
Priority LOW 26
The Mechanize library is used for automating interaction with websites.
TI-2020-16068 CVE-2020-26247 · GHSA-vr8q-g5c7-m54m
XXE in Nokogiri
Priority LOW 22
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support.
TI-2026-41373 CVE-2026-57436
Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
Priority LOW 18
Nokogiri is an open source XML and HTML library for the Ruby programming language.
TI-2026-41371 CVE-2026-57434
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
Priority LOW 16
Nokogiri is an open source XML and HTML library for the Ruby programming language.