Description

Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via CVE-2022-23308 in libxml2, an application parsing an untrusted document with parse option DTDVALID set to true and NOENT set to false may be vulnerable to denial of service, memory disclosure, or code execution. Nokogiri 1.13.2 upgrades vendored libxml2 to 2.9.13 and libxslt to 1.1.35.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T16:16:44.380Z",
  "pubdate": "2026-08-25T16:16:44.380Z",
  "executiveSummary": "Nokogiri versions prior to 1.13.2, when utilizing bundled (vendored) libraries, are susceptible to security risks stemming from outdated versions of libxml2 (2.9.12) and libxslt (1.1.34). These bundled dependencies contain critical vulnerabilities identified as CVE-2021-30560 and CVE-2022-23308. The vulnerabilities encompass multiple impact vectors, including denial-of-service (DoS), unauthorized memory disclosure, and potential arbitrary code execution.\nThe risk is primarily realized when applications perform operations on untrusted inputs, such as parsing malicious XML documents or processing untrusted XSL stylesheets. Depending on specific configuration flags, such as DTDVALID and NOENT, an attacker may be able to manipulate library behavior to crash the service, leak sensitive memory contents, or execute arbitrary payloads. These vulnerabilities highlight the inherent risks of shipping internal, unmanaged binary dependencies within language-specific packages. Organizations utilizing affected Nokogiri versions are exposed to remote exploitation if their input processing workflows do not strictly sanitize or validate incoming XML and XSL data. Upgrading to version 1.13.2 or later is the primary mechanism to remediate these issues, as it enforces the use of more secure versions (libxml2 2.9.13 and libxslt 1.1.35) of the underlying C libraries.",
  "technicalDetails": "The vulnerability set affects Nokogiri’s CRuby implementation when the gem is configured to use its bundled libxml2 and libxslt binaries rather than system-provided versions. The exposure is derived from two upstream vulnerabilities in these dependencies.\nCVE-2021-30560 concerns libxslt 1.1.34. This vulnerability is associated with how the XSLT engine handles stylesheet transformations. An attacker providing a maliciously crafted XSL stylesheet can trigger a denial-of-service condition. Because libxslt is often used in web applications to transform user-supplied XML data, the attack flow involves injecting a weaponized XSL document into the transformation pipeline. The root cause lies in improper memory management or state tracking during the transformation process, leading to resource exhaustion or process crashes.\nCVE-2022-23308 concerns libxml2 2.9.12 and introduces more severe risks, including potential remote code execution (RCE). The vulnerability is triggered under specific parsing configurations, particularly when the DTDVALID option is enabled (instructing the parser to validate the document against a DTD) while the NOENT (entity substitution) option is set to false. This combination creates a logical flaw in the document parsing engine, potentially leading to heap-based buffer overflows or use-after-free conditions.\nThe exploitation flow for CVE-2022-23308 typically involves an attacker supplying a malformed XML document that utilizes external entities or complex DTD structures designed to confuse the parser's validation logic. When the parser attempts to resolve or validate these structures under the specified flag constraints, it reaches an undefined state in the underlying C code. If successful, the attacker can influence memory pointers, leading to information disclosure (reading arbitrary memory contents back to the application output) or memory corruption that facilitates code execution. The severity of these impacts is dependent on the application's specific implementation of the Nokogiri parser API. Since the libraries are linked directly into the Ruby process space, the exploitation does not require separate authentication if the application accepts public input. The attack is network-exploitable if the application facilitates the ingestion of XML data from external sources, such as web request bodies or API endpoints. Nokogiri 1.13.2 effectively mitigates these risks by updating the vendored binaries to libxml2 2.9.13 and libxslt 1.1.35, which incorporate patches for these memory safety and state-handling defects."
}