EUVD-2026-65527
GHSA-58vh-2xxg-v7j2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor confirms trigger requires developer coding error in application source; no remote or untrusted-input vector is possible, so AV:L and PR:H apply with availability-only impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.
AnalysisAI
Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code incorrectly passes a non-Node argument to the protected internal Node#initialize_copy_with_args method. The method backs the public Node#dup and #clone APIs and, prior to 1.19.4, unwraps its argument directly as a libxml2 xmlNode struct without verifying the object's type, causing it to misread an xmlNs (Namespace) struct out of bounds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires application source code to contain a programming error: specifically, a call - direct or indirect via `Node#dup` or `#clone` - to the protected method `Node#initialize_copy_with_args` with a non-Node Nokogiri object (e.g., a Namespace) as the argument. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) yields a score of 8.7 but materially conflicts with the vendor's own description, which states the flaw 'cannot be triggered by untrusted input or normal use of the public API' and is 'only triggerable by a programming error.' A vector of AV:N/PR:N implies any remote unauthenticated attacker can crash the process, which is factually incorrect per the advisory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A Ruby application using Nokogiri before 1.19.4 on CRuby contains a developer coding error where a Nokogiri Namespace object (rather than a Node) is inadvertently passed to `Node#dup` or `Node#clone`, routing through the unguarded `initialize_copy_with_args` helper. The C extension misinterprets the `xmlNs` memory layout as `xmlNode`, reads out of bounds, and the Ruby process crashes with a segmentation fault. … |
| Remediation | Upgrade to Nokogiri 1.19.4 or later; this release introduces an explicit type check in `Node#initialize_copy_with_args` and raises a `TypeError` on mismatched input instead of performing the out-of-bounds read, as confirmed by the vendor advisory GHSA-g9g8-vgvw-g3vf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit application code using Nokogiri to identify any usage of Node#dup or Node#clone methods, particularly patterns where internal code might pass incorrect argument types to these APIs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bu
Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and pr
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenize
Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against
Out-of-bounds read in Nokogiri's `NodeSet#[]` method (all versions before 1.19.4) enables an attacker who can supply a l
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today