EUVD-2026-39429Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because vulnerability triggers only inside local application code calling the library API; AC:H reflects the unusual three-step misuse pattern required; no OS-level privileges needed to invoke a Ruby method (PR:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.
AnalysisAI
Use-after-free in Nokogiri's CRuby XInclude processing (versions prior to 1.19.4) can leave Ruby wrapper objects pointing at freed libxml2 memory after #do_xinclude is called on a document whose nodes have already been exposed to Ruby. An application that triggers this condition may experience invalid memory reads or writes, potentially resulting in a crash or memory disclosure. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 2.2 reflects the high attack complexity driven by an unusual, non-default API usage pattern required to reach the vulnerable code path.
Technical ContextAI
Nokogiri is the dominant XML and HTML parsing library for Ruby, wrapping libxml2 at the C extension layer in its CRuby (MRI) implementation. The vulnerable code path is Nokogiri::XML::Node#do_xinclude, which invokes libxml2's XInclude substitution engine. During substitution, libxml2 replaces each <xi:include> element in the document tree in place, freeing that element along with its children (<xi:fallback> and descendants) and any XML namespaces declared on them. Nokogiri's Ruby object layer wraps these libxml2 C structures by pointer; when libxml2 frees a structure that a Ruby object already references, the Ruby object becomes a dangling pointer - a textbook CWE-416 (Use After Free). The fix in 1.19.4 changes #do_xinclude to operate on a defensive copy of the relevant subtrees so that libxml2 only ever frees structures with no live Ruby bindings. The CPE is cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:* with versions below 1.19.4. The JRuby implementation uses a different XML backend and is explicitly not affected.
RemediationAI
Upgrade Nokogiri to version 1.19.4 or later, which is the vendor-released patch confirmed by the maintainers via GHSA-wfpw-mmfh-qq69. The patched release introduces defensive copy behavior in #do_xinclude and requires no changes to application code. For applications that cannot immediately upgrade, the maintainers provide a specific workaround: perform XInclude substitution at parse time by passing the xinclude parse option (e.g., Nokogiri::XML(xml_string, &:xinclude)) rather than calling #do_xinclude on a document that has already been traversed. A freshly parsed document has no internal nodes yet exposed to Ruby object bindings, so the substitution is safe. The trade-off is that this workaround changes when XInclude processing occurs and may not suit applications that intentionally separate parsing from XInclude resolution. See https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wfpw-mmfh-qq69 for full mitigation guidance.
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bu
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenize
Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and pr
Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code
Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today