TI-2022-11724 Aliases CVE-2022-29181 GHSA-xh29-r2w5-wx8m

Improper Handling of Unexpected Data Type in Nokogiri

HIGH 75CWE-241Published 2022-05-20 · Updated 2025-05-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · High
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0323 88th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial nokogiri (sparklemotion): 1.13.6nokogiri (RubyGems): 1.13.6Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sparklemotion	nokogiri	before 1.13.6	1.13.6	Patch available	CNA
—	nokogiri (RubyGems)	before 1.13.6	1.13.6	Patch available	GHSA-xh29-r2w5-wx8m

nokogiri Vendorsparklemotion Affected before 1.13.6 Fixed in 1.13.6 Patch available CNA
nokogiri (RubyGems) Vendor— Affected before 1.13.6 Fixed in 1.13.6 Patch available GHSA-xh29-r2w5-wx8m

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:nokogiri:nokogiri::::::ruby::*	before 1.13.6	Vulnerable	sparklemotion
cpe:2.3:o:apple:macos::::::::	13.0 to before 13.1	Vulnerable	Apple

cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:* Versions before 1.13.6 Vulnerable ·sparklemotion
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions 13.0 to before 13.1 Vulnerable ·Apple

Remediation

Fix · CNA nokogiri (sparklemotion) Fixed in 1.13.6
Fix · GHSA-xh29-r2w5-wx8m nokogiri (RubyGems) Fixed in 1.13.6 Advisory →

Red Hat 1 advisory

RHSA-2022:8506 Released 2022-11-16 · Red Hat rating Important
Satellite 6.12 Release
- Red Hat Satellite 6.12 for RHEL 8 candlepin-4.1.15-1.el8sat, candlepin-selinux-4.1.15-1.el8sat, foreman-3.3.0.17-1.el8sat +19

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
CloudForms Management Engine 5	Affected	No fix planned: Will not fix
Red Hat Satellite 6.12 for RHEL 8	Fixed	RHSA-2022:8506

Not affected: 1 product

Red Hat Satellite 6.12 for RHEL 8

Timeline

2026-10-02 Threatist record created from CVE-2022-29181
2026-10-03 Alias added: GHSA-xh29-r2w5-wx8m

References

Exploit 1

https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri/

Patch 1

https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267

Advisory 7

Other 3

TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
TI-2019-03885 OS command injection in Nokogiri CVSS 3.1CRITICAL 9.8
TI-2026-55247 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer CVSS 4.0HIGH 8.7
TI-2022-07536 Unchecked return value from xmlTextReaderExpand in Nokogiri CVSS 3.1HIGH 7.5
TI-2022-08648 Inefficient Regular Expression Complexity in Nokogiri CVSS 3.1HIGH 7.5
TI-2026-55248 Nokogiri before 1.19.3 Memory Leak via XSLT Transform CVSS 4.0MEDIUM 6.9

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences