Nokogiri CVE-2026-57234

Exploitation requires: (1) the target Ruby application must be running on the JRuby implementation - CRuby deployments at any Nokogiri version are immune; (2) the application must use Nokogiri::XML::Schema to parse XML schemas, specifically with default parse options (NONET enabled); (3) the attacker must be able to supply or influence the schema content processed by the application, since the bypass is triggered by external resource references embedded in the schema itself; and (4) CVSS PR:L indicates some level of authenticated or low-privilege access is required, and UI:R indicates a user or process action must trigger the schema parse. Applications that do not parse schemas from untrusted sources, or that run on CRuby, face no exposure from this vulnerability. The limiting factors - JRuby-only, schema-input control, PR:L, UI:R - significantly constrain the realistic attacker population.

CVSS 2.6 (Low) is internally consistent with the vector AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N, reflecting high attack complexity, a required low-privileged authenticated context, mandatory user interaction, and only limited confidentiality impact. The JRuby-only scope is a hard architectural constraint that eliminates risk for the majority of Nokogiri deployments, which run on CRuby. This is a bypass of CVE-2020-26247, scored identically, and represents an incomplete fix rather than a novel attack class. No EPSS data was provided, so quantitative exploitation probability cannot be stated; however, the absence of KEV listing, no identified POC, and the niche JRuby deployment requirement collectively suggest low real-world exploitation pressure. The SSRF/XXE impact is limited to confidentiality (C:L) with no integrity or availability component. The primary concern is in environments that parse attacker-controlled XML schemas on JRuby - a non-default workflow that requires deliberate application design. Risk is real but operationally narrow; this should be patched in normal release cycles rather than treated as an emergency.

An attacker crafts a malicious XML Schema document containing references to attacker-controlled external URLs using alternate-case scheme strings (exploiting the case-sensitive denylist bypass) and submits it to a JRuby-based Ruby application that uses Nokogiri::XML::Schema for schema validation with default parse options. The application's Nokogiri JRuby implementation issues an outbound HTTP request to the attacker's server despite NONET being set, enabling the attacker to map internal network topology via SSRF or extract data via XXE response channels. No public exploit code has been identified, and the high attack complexity - requiring JRuby runtime, attacker-controlled schema input, and user interaction - suggests exploitation would be targeted rather than opportunistic.