EUVD-2026-39421Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Requires JRuby runtime, attacker-supplied schema, and user interaction (AC:H, PR:L, UI:R); impact limited to SSRF/XXE data disclosure with no integrity or availability consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
AnalysisAI
NONET network restriction bypass in Nokogiri's JRuby implementation permits external resource fetching during XML Schema parsing despite the default network-blocking parse option being set, exposing applications to potential SSRF and XXE attacks. Only JRuby-based deployments are affected - CRuby users are fully protected because libxml2's xmlNoNetExternalEntityLoader enforces NONET at the I/O layer independently of Nokogiri's option handling. Rated low severity by maintainers (CVSS 2.6); vendor-released patch is available in version 1.19.4, and no public exploit has been identified at time of analysis.
Technical ContextAI
Nokogiri is a widely used Ruby gem that wraps libxml2 for the CRuby runtime and uses a separate Java-based XML parser for JRuby. The NONET parse option was introduced as a default for Nokogiri::XML::Schema following CVE-2020-26247 to block network resource resolution during schema parsing. The JRuby implementation enforced this restriction via a network-scheme denylist, but CWE-178 (Improper Handling of Case Sensitivity) indicates the denylist performed case-sensitive matching, allowing bypasses via alternate-case scheme values (e.g., 'HTTP://' instead of 'http://'). The fix in 1.19.4 replaces the denylist with a case-insensitive allowlist that permits only file: scheme and local path references, aligning JRuby behavior with CRuby. The affected CPE is cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:*, covering all Nokogiri versions prior to 1.19.4 on JRuby.
RemediationAI
Upgrade to Nokogiri 1.19.4 or later via gem update nokogiri or by updating the Gemfile pin; this is the only confirmed fix per the vendor advisory at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2. The vendor confirms no workarounds exist for affected versions. Note that 1.19.4 introduces a breaking change: the NONET denylist is replaced with an allowlist, so any application that previously relied (even unknowingly) on network resource loading with default parse options will have that access blocked. If trusted schemas genuinely require network resource resolution, explicitly disable NONET using Nokogiri::XML::ParseOptions.new.nononet - but only for inputs that are fully trusted, as this re-enables the original network-access risk documented in CVE-2020-26247.
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bu
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenize
Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and pr
Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code
Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allShare
External POC / Exploit Code
Leaving vuln.today