EUVD-2026-65530
GHSA-xqqh-3w52-q8p7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for required SAML deployment context; S:C and C:H/I:H reflect downstream authentication bypass enabling full account takeover.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
AnalysisAI
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the canonicalize method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: the target application must use the CRuby (MRI) implementation of Nokogiri, not JRuby; Nokogiri must be at version 1.5.1 or later but below 1.19.1; the application or a downstream library (such as a SAML toolkit) must invoke `Nokogiri::XML::Document#canonicalize` or `Nokogiri::XML::Node#canonicalize` as part of XML signature or SAML assertion verification; and the downstream library must not independently validate that the canonicalized output is non-empty before using it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) captures only Nokogiri's direct impact - a method returning incorrect data - and materially understates the real-world consequence in SAML-dependent deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a Rails application using SAML SSO (e.g., via OmniAuth-SAML or ruby-saml) submits a crafted SAML response whose signed canonicalized XML is deliberately malformed. Nokogiri's CRuby canonicalize method fails silently and returns an empty string; the SAML library receives this as the canonicalized form, causing signature verification to succeed on attacker-controlled content. … |
| Remediation | Upgrade Nokogiri to version 1.19.1 or later, the vendor-released patch confirmed by the GHSA-wx95-c6cv-8532 advisory at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bu
Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and pr
Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenize
Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against
Out-of-bounds read in Nokogiri's `NodeSet#[]` method (all versions before 1.19.4) enables an attacker who can supply a l
Same weakness CWE-252 – Unchecked Return Value
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today