Priority LOW 36
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-08-25 · Partial fix · 1.19.1 CWE-252
Priority LOW 37
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00423 · Published 2026-08-25 · Partial fix · 1.19.3 CWE-401
Priority MEDIUM 44
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00493 · Published 2026-08-25 · Fixed in 1.19.3 CWE-1333
Priority LOW 10
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 4.0LOW 2.2· Local · No auth · No interaction · EPSS 0.00125 · Published 2026-06-25 · Partial fix · 1.19.4 CWE-416
Priority LOW 10
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 4.0LOW 1.7· Network · No auth · No interaction · EPSS 0.00402 · Published 2026-06-25 · Partial fix · 1.19.4 CWE-416
Priority LOW 18
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 4.0LOW 1.7· Network · No auth · No interaction · EPSS 0.00402 · Published 2026-06-25 · Partial fix · 1.19.4 CWE-416
Priority LOW 10
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 4.0LOW 1.7· Network · No auth · No interaction · EPSS 0.0046 · Published 2026-06-25 · Partial fix · 1.19.4 CWE-416
Priority LOW 16
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 4.0LOW 1.7· Network · No auth · No interaction · EPSS 0.0046 · Published 2026-06-25 · Partial fix · 1.19.4 CWE-476
Priority LOW 28
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00426 · Published 2026-06-25 · Partial fix · 1.19.4 CWE-125
Priority LOW 13
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 3.1LOW 2.6· Network · Low privileges · User interaction · EPSS 0.00198 · Published 2026-06-25 · Fixed in 1.19.4 CWE-178
Priority LOW 10
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 4.0LOW 1.7· Network · No auth · No interaction · EPSS 0.00426 · Published 2026-06-25 · Partial fix · 1.19.4 CWE-416
Priority MEDIUM 42
Nokogiri is an open source XML and HTML library for the Ruby programming language.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01823 · Published 2022-12-08 · Partial fix · 1.13.10 CWE-252
Priority HIGH 75
Nokogiri is an open source XML and HTML library for Ruby.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.0323 · Published 2022-05-20 · Partial fix · 1.13.6 CWE-241
Priority LOW 39
Nokogiri is an open source XML and HTML library for Ruby.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03519 · Published 2022-04-11 · Partial fix · 1.13.4 CWE-1333
Priority HIGH 72
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.51733 · Published 2022-03-25 · Fixed in 1.13.4 CWE-787
Priority LOW 36
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0146 · Published 2021-09-27 · Partial fix · 1.12.5 CWE-611
Priority LOW 22
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01181 · Published 2020-12-30 · Partial fix · 1.11.0.rc4, 1.11.0 CWE-611
Priority LOW 37
Nokogiri before 1.5.4 is vulnerable to XXE attacks
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02168 · Published 2020-02-19 · Partial fix · 1.5.4 CWE-776
Priority LOW 33
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02194 · Published 2019-11-05 · Fixed in 1.5.11, 1.6.1 CWE-776
Priority LOW 33
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02083 · Published 2019-11-05 · Fixed in 1.5.11, 1.6.1 CWE-776
Priority MEDIUM 51
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05899 · Published 2019-08-16 · Fixed in 1.10.4, 1.0.7 CWE-78
THREATIST.IORead the docs