Nokogiri EUVD-2026-65530

Exploitation requires all of the following: the target application must use the CRuby (MRI) implementation of Nokogiri, not JRuby; Nokogiri must be at version 1.5.1 or later but below 1.19.1; the application or a downstream library (such as a SAML toolkit) must invoke Nokogiri::XML::Document#canonicalize or Nokogiri::XML::Node#canonicalize as part of XML signature or SAML assertion verification; and the downstream library must not independently validate that the canonicalized output is non-empty before using it. The CVSS 4.0 vector (PR:N, AC:L, AT:N) reflects that no attacker authentication or special complexity is required once these conditions are met. Applications that use Nokogiri exclusively for HTML/XML parsing and never call canonicalize in a signature verification path are not exposed regardless of version.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) captures only Nokogiri's direct impact - a method returning incorrect data - and materially understates the real-world consequence in SAML-dependent deployments. The downstream authentication bypass is the primary risk vector: any Ruby application using SAML SSO that routes signature verification through Nokogiri's canonicalize method is potentially vulnerable to unauthenticated account takeover. Nokogiri's own maintainers rated this Medium, correctly noting that the library lacks a direct security boundary around canonicalization; however, the demonstrated SAML bypass makes this a priority patch for any Rails/Ruby environment with SSO. EPSS data is absent from available input, preventing probabilistic exploitation forecasting. No CISA KEV listing exists, and no public exploit code has been identified, distinguishing this from mass-exploitation scenarios. The real-world risk is best characterized as moderate-to-high for SAML-enabled applications and negligible for applications not invoking canonicalize in a signature verification context.

An attacker targeting a Rails application using SAML SSO (e.g., via OmniAuth-SAML or ruby-saml) submits a crafted SAML response whose signed canonicalized XML is deliberately malformed. Nokogiri's CRuby canonicalize method fails silently and returns an empty string; the SAML library receives this as the canonicalized form, causing signature verification to succeed on attacker-controlled content. The attacker authenticates as any user - including administrators - without valid credentials. No public exploit code has been confirmed, but the technique was validated by HackerOne researcher d4d.