Version 1.16.7

nokogiri

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby.

Install Instructions

gem install nokogiri
Current Version Release Date July 27, 2024
Language Ruby
Package URL (purl) pkg:gem/nokogiri@1.16.7

Find nokogiri vulnerabilities in your supply chain.

Scan for Free

nokogiri Vulnerabilities

Sort by
icon CVVS Score
  • icon CVVS Score
  • icon CVVS Score
  • icon CVE
  • icon CVE
CVSS Score question mark icon CVE question mark icon CWE(s) question mark icon EPSS Score question mark icon EPSS % question mark icon Impacted Versions
High 7.5 CVE-2012-6685 CWE-200, CWE-776 0.00182 0.55926
  • 1.0.0–1.5.4.rc3
Medium 6.5 CVE-2013-6460 CWE-400, CWE-776 0.00427 0.74715
  • 1.0.0–1.6.0.rc1
Medium 6.5 CVE-2013-6461 CWE-400, CWE-776 0.00353 0.72253
  • 1.0.0–1.6.0.rc1
High 9.8 CVE-2016-4658 CWE-119 0.01921 0.8888
  • 1.0.0–1.7.0.1
High 7.8 CVE-2017-0663 CWE-89, CWE-119, CWE-200, CWE-284, CWE-399, CWE-126, CWE-611 0.01922 0.88883
  • 1.0.0–1.8.0
High 8.8 CVE-2017-15412 CWE-400, CWE-416 0.02136 0.89482
  • 1.0.0–1.8.1
High 7.5 CVE-2017-16932 CWE-835, CWE-400 0.01108 0.84773
  • 1.0.0–1.8.0
Medium 6.5 CVE-2017-18258 CWE-770 0.01726 0.88151
  • 1.0.0–1.8.1
High 8.8 CVE-2017-5029 CWE-787 0.02041 0.89224
  • 1.0.0–1.7.1
High 9.8 CVE-2017-7375 CWE-89, CWE-119, CWE-200, CWE-284, CWE-399, CWE-126, CWE-611 0.00529 0.77336
  • 1.0.0–1.8.0
High 7.5 CVE-2017-7376 CWE-89, CWE-119, CWE-200, CWE-284, CWE-399, CWE-126, CWE-125, CWE-611 0.34139 0.97152
  • 1.0.0–1.8.0
High 7.5 CVE-2017-9047 CWE-89, CWE-119, CWE-200, CWE-284, CWE-399, CWE-126, CWE-125, CWE-611 0.00289 0.69292
  • 1.0.0–1.8.0
High 7.5 CVE-2017-9048 CWE-89, CWE-119, CWE-200, CWE-284, CWE-399, CWE-126, CWE-611 0.00289 0.69292
  • 1.0.0–1.8.0
High 7.5 CVE-2017-9049 CWE-125 0.00203 0.58351
  • 1.0.0–1.8.0
High 7.5 CVE-2017-9050 CWE-125 0.00203 0.58351
  • 1.0.0–1.8.0
High 7.5 CVE-2018-14404 CWE-476 0.02983 0.9106
  • 1.0.0–1.8.4
High 7.5 CVE-2018-25032 CWE-787 0.00278 0.68593
  • 1.0.0–1.13.3
Medium 6.1 CVE-2018-8048 CWE-79 0.00208 0.58901
  • 1.0.0–1.8.2
High 9.8 CVE-2019-11068 0.00256 0.65622
  • 1.0.0–1.10.2
Medium 5.3 CVE-2019-13117 CWE-908 0.00798 0.81927
  • 1.0.0–1.10.4
Medium 5.3 CVE-2019-13118 CWE-843 0.00369 0.72901
  • 1.0.0–1.10.4
High 7.5 CVE-2019-18197 CWE-416, CWE-908 0.00793 0.81871
  • 1.0.0–1.10.4
High 8.6 CVE-2019-20388 CWE-476, CWE-119, CWE-401, CWE-416, CWE-787, CWE-125 0.00867 0.82665
  • 1.0.0–1.11.3
High 9.8 CVE-2019-5477 CWE-78 0.02421 0.90165
  • 1.0.0–1.10.3
High 7.5 CVE-2019-5815 CWE-843, CWE-787 0.00432 0.74887
  • 1.0.0–1.10.4
Medium 4.3 CVE-2020-26247 CWE-611 0.00162 0.5331
  • 1.0.0–1.11.0.rc3
High 7.5 CVE-2020-7595 CWE-835 0.00593 0.78623
  • 1.0.0–1.10.7
High 8.8 CVE-2021-30560 CWE-416 0.00701 0.80559
  • 1.0.0–1.13.1
High 8.6 CVE-2021-3517 CWE-476, CWE-119, CWE-416, CWE-787, CWE-125 0.01688 0.88002
  • 1.0.0–1.11.3
High 8.8 CVE-2021-3518 CWE-416 0.00411 0.74244
  • 1.0.0–1.11.3
Medium 5.9 CVE-2021-3537 CWE-476 0.01401 0.86687
  • 1.0.0–1.11.3
High 7.5 CVE-2021-41098 CWE-611 0.00136 0.49643
  • 1.0.0–1.12.5
Medium 6.5 CVE-2022-23437 CWE-91 0.00474 0.76
  • 1.0.0–1.13.3
High 7.5 CVE-2022-24836 CWE-400, CWE-1333 0.00546 0.77731
  • 1.0.0–1.13.3
High 7.5 CVE-2022-24839 CWE-400 0.00194 0.57489
  • 1.0.0–1.9.1
High 8.2 CVE-2022-29181 CWE-241 0.00368 0.72874
  • 1.0.0–1.13.5
High 7.1 CVE-2015-5312 CWE-400, CWE-399 0.00613 0.78989
  • 1.6.0–1.6.7.rc4
Medium 5 CVE-2015-7499 CWE-200, CWE-400, CWE-119 0.00247 0.64954
  • 1.6.0–1.6.7.1
High 7.5 CVE-2015-8806 CWE-94, CWE-400, CWE-119 0.02168 0.89565
  • 1.6.0–1.6.8.rc3
Medium 5 CVE-2015-1819 CWE-400, CWE-399 0.02489 0.90303
  • 1.6.6.1–1.6.6.3
High 7.5 CVE-2022-23476 CWE-476, CWE-252 0.00121 0.47128
  • 1.13.8–1.13.9

nokogiri Vulnerability Remediation Guidance

CVE Description Full list of Impacted Versions Fix
CVE-2012-6685 Nokogiri before 1.5.4 is vulnerable to XXE attacks 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.4.4, 1.4.4.1, 1.5.3.rc5, 1.5.1.rc1 (Show all) Minor → 1.13.6
CVE-2013-6460 Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.4.4, 1.5.10, 1.5.9, 1.5.6 (Show all) Minor → 1.13.6
CVE-2013-6461 Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.4.4, 1.5.10, 1.5.9, 1.5.6 (Show all) Minor → 1.13.6
CVE-2016-4658 xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-0663 A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-15412 Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-16932 parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-18258 The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-5029 The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-7375 A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable). 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-7376 Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-9047 A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-9048 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-9049 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2017-9050 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2018-14404 A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2018-25032 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2018-8048 In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2019-11068 libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2019-13117 In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2019-13118 In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2019-18197 In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2019-20388 xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2019-5477 A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2019-5815 Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2020-26247 Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2020-7595 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2021-30560 Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2021-3517 There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2021-3518 There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2021-3537 A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2021-41098 Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2022-23437 There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2022-24836 Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2022-24839 org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2022-29181 Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.6.7 (Show all) Minor → 1.13.6
CVE-2015-5312 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660. 1.6.7, 1.6.6.3, 1.6.5, 1.6.0, 1.6.7.rc3, 1.6.6.2, 1.6.6.4, 1.6.7.rc4 (Show all) Minor → 1.13.6
CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors. 1.6.7, 1.6.6.3, 1.6.5, 1.6.0, 1.6.7.rc3, 1.6.7.1, 1.6.6.2, 1.6.6.4 (Show all) Minor → 1.13.6
CVE-2015-8806 dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document. 1.6.7, 1.6.6.3, 1.6.5, 1.6.0, 1.6.7.rc3, 1.6.7.1, 1.6.7.2, 1.6.6.2 (Show all) Minor → 1.13.6
CVE-2015-1819 The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack. 1.6.6.3, 1.6.6.2, 1.6.6.1 Patch → 1.13.6
CVE-2022-23476 Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected. 1.13.8, 1.13.9 Patch → 1.13.10

Instantly see if these nokogiri vulnerabilities affect your code.

Scan for Free

Dependencies

Packages using versions of lodash affected by its vulnerabilities

Dependent Packages
mini_portile2~> 2.8.2
racc~> 1.4