sparklemotion

Records32All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

sparklemotion records in CISA KEV

No sparklemotion vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Nokogiri 21 records HIGH

Records

21 records in Nokogiri · all components

TI-2022-11724 CVE-2022-29181 · GHSA-xh29-r2w5-wx8m

Improper Handling of Unexpected Data Type in Nokogiri

HIGH 75

Nokogiri is an open source XML and HTML library for Ruby.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0323 Published 2022-05-20 Partial fix · 1.13.6 CWE-241

TI-2018-15259 CVE-2018-25032 · GHSA-jc36-42cf-vqwj

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if…

HIGH 72

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.51733 Published 2022-03-25 Fixed in 1.13.4 CWE-787

TI-2019-03885 CVE-2019-5477 · GHSA-cr5j-953j-xw5p

OS command injection in Nokogiri

MEDIUM 51

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05899 Published 2019-08-16 Fixed in 1.10.4, 1.0.7 CWE-78

TI-2026-55247 CVE-2026-79770 · GHSA-c4rq-3m3g-8wgx

Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

MEDIUM 44

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-08-25 Fixed in 1.19.3 CWE-1333

TI-2022-07536 CVE-2022-23476 · GHSA-qv4q-mr5r-qprj

Unchecked return value from xmlTextReaderExpand in Nokogiri

MEDIUM 42

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01823 Published 2022-12-08 Partial fix · 1.13.10 CWE-252

TI-2022-08648 CVE-2022-24836 · GHSA-crjr-9rc5-ghw8

Inefficient Regular Expression Complexity in Nokogiri

LOW 39

Nokogiri is an open source XML and HTML library for Ruby.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03519 Published 2022-04-11 Partial fix · 1.13.4 CWE-1333

TI-2026-55248 CVE-2026-79771 · GHSA-v2fc-qm4h-8hqv

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

LOW 37

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00423 Published 2026-08-25 Partial fix · 1.19.3 CWE-401

TI-2012-05390 CVE-2012-6685 · GHSA-6wj9-77wq-jq7p

Nokogiri before 1.5.4 is vulnerable to XXE attacks

LOW 37

Nokogiri before 1.5.4 is vulnerable to XXE attacks

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02168 Published 2020-02-19 Partial fix · 1.5.4 CWE-776

TI-2026-55249 CVE-2026-79772 · GHSA-wx95-c6cv-8532

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

LOW 36

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00342 Published 2026-08-25 Partial fix · 1.19.1 CWE-252

TI-2021-17940 CVE-2021-41098 · GHSA-2rr5-8q37-2w7h

Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

LOW 36

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0146 Published 2021-09-27 Partial fix · 1.12.5 CWE-611

TI-2013-05414 CVE-2013-6461 · GHSA-jmhh-w7xp-wg39

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

LOW 33

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02194 Published 2019-11-05 Fixed in 1.5.11, 1.6.1 CWE-776

TI-2013-05413 CVE-2013-6460 · GHSA-62qp-3fxm-9wxf

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

LOW 33

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02083 Published 2019-11-05 Fixed in 1.5.11, 1.6.1 CWE-776

TI-2026-41173 CVE-2026-57235

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

LOW 28

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00426 Published 2026-06-25 Partial fix · 1.19.4 CWE-125

TI-2020-16068 CVE-2020-26247 · GHSA-vr8q-g5c7-m54m

XXE in Nokogiri

LOW 22

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01181 Published 2020-12-30 Partial fix · 1.11.0.rc4, 1.11.0 CWE-611

TI-2026-41373 CVE-2026-57436

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

LOW 18

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00402 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2026-41371 CVE-2026-57434

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

LOW 16

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.0046 Published 2026-06-25 Partial fix · 1.19.4 CWE-476

TI-2026-41172 CVE-2026-57234

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

LOW 13

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 3.1LOW 2.6 Network Low privileges User interaction EPSS 0.00198 Published 2026-06-25 Fixed in 1.19.4 CWE-178

TI-2026-41375 CVE-2026-57438

Nokogiri: Possible Use-After-Free in XInclude Processing

LOW 10

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 2.2 Local No auth No interaction EPSS 0.00125 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2026-41374 CVE-2026-57437

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

LOW 10

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00402 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2026-41372 CVE-2026-57435

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

LOW 10

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.0046 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2026-41174 CVE-2026-57236

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

LOW 10

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00426 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

Open these records in search →

Critical	1
High	11
Medium	11
Low	9
No CVSS	0