Version 1.16.7

nokogiri

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby.

Install Instructions

gem install nokogiri
Current Version Release Date July 27, 2024
Language Ruby
Package URL (purl) pkg:gem/nokogiri@1.16.7

Find nokogiri vulnerabilities in your supply chain.

Scan for Free

nokogiri Vulnerabilities

Sort by
icon CVE (Latest)
  • icon CVE (Latest)
  • icon CVE (Oldest)
  • icon CVSS Score (Highest)
  • icon CVSS Score (Lowest)
CVE question mark icon CVSS Score question mark icon CWE(s) question mark icon EPSS Score question mark icon EPSS % question mark icon Impacted Versions
CVE-2012-6685 High 7.5 CWE-776, CWE-200 0.00182 0.56618
  • 1.0.0–1.5.4.rc3
CVE-2013-6460 Medium 6.5 CWE-776, CWE-400 0.00493 0.76894
  • 1.0.0–1.6.0.rc1
CVE-2013-6461 Medium 6.5 CWE-776, CWE-400 0.0042 0.74925
  • 1.0.0–1.6.0.rc1
CVE-2016-4658 High 9.8 CWE-119 0.01965 0.89207
  • 1.0.0–1.7.0.1
CVE-2017-0663 High 7.8 CWE-611, CWE-284, CWE-200, CWE-399, CWE-89, CWE-119, CWE-126 0.01364 0.86785
  • 1.0.0–1.8.0
CVE-2017-15412 High 8.8 CWE-416, CWE-400 0.02136 0.89668
  • 1.0.0–1.8.1
CVE-2017-16932 High 7.5 CWE-835, CWE-400 0.01108 0.85075
  • 1.0.0–1.8.0
CVE-2017-18258 Medium 6.5 CWE-770 0.01726 0.88353
  • 1.0.0–1.8.1
CVE-2017-5029 High 8.8 CWE-787 0.02041 0.89427
  • 1.0.0–1.7.1
CVE-2017-7375 High 9.8 CWE-611, CWE-284, CWE-200, CWE-399, CWE-89, CWE-119, CWE-126 0.00529 0.7772
  • 1.0.0–1.8.0
CVE-2017-7376 High 7.5 CWE-611, CWE-284, CWE-200, CWE-399, CWE-89, CWE-119, CWE-125, CWE-126 0.34139 0.97222
  • 1.0.0–1.8.0
CVE-2017-9047 High 7.5 CWE-611, CWE-284, CWE-200, CWE-399, CWE-89, CWE-119, CWE-125, CWE-126 0.00289 0.69726
  • 1.0.0–1.8.0
CVE-2017-9048 High 7.5 CWE-611, CWE-284, CWE-200, CWE-399, CWE-89, CWE-119, CWE-126 0.00289 0.69726
  • 1.0.0–1.8.0
CVE-2017-9049 High 7.5 CWE-125 0.00203 0.58998
  • 1.0.0–1.8.0
CVE-2017-9050 High 7.5 CWE-125 0.00203 0.58998
  • 1.0.0–1.8.0
CVE-2018-14404 High 7.5 CWE-476 0.02983 0.91238
  • 1.0.0–1.8.4
CVE-2018-25032 High 7.5 CWE-787 0.0034 0.72195
  • 1.0.0–1.13.3
CVE-2018-8048 Medium 6.1 CWE-79 0.00208 0.59543
  • 1.0.0–1.8.2
CVE-2019-11068 High 9.8 0.00275 0.68846
  • 1.0.0–1.10.2
CVE-2019-13117 Medium 5.3 CWE-908 0.00676 0.80477
  • 1.0.0–1.10.4
CVE-2019-13118 Medium 5.3 CWE-843 0.00369 0.73342
  • 1.0.0–1.10.4
CVE-2019-18197 High 7.5 CWE-416, CWE-908 0.01271 0.86233
  • 1.0.0–1.10.4
CVE-2019-20388 High 8.6 CWE-416, CWE-119, CWE-125, CWE-401, CWE-476, CWE-787 0.00867 0.83012
  • 1.0.0–1.11.3
CVE-2019-5477 High 9.8 CWE-78 0.02421 0.90344
  • 1.0.0–1.10.3
CVE-2019-5815 High 7.5 CWE-843, CWE-787 0.00305 0.70498
  • 1.0.0–1.10.4
CVE-2020-26247 Medium 4.3 CWE-611 0.00221 0.60969
  • 1.0.0–1.11.0.rc3
CVE-2020-7595 High 7.5 CWE-835 0.00593 0.78987
  • 1.0.0–1.10.7
CVE-2021-30560 High 8.8 CWE-416 0.00701 0.80897
  • 1.0.0–1.13.1
CVE-2021-3517 High 8.6 CWE-416, CWE-119, CWE-125, CWE-476, CWE-787 0.01688 0.88215
  • 1.0.0–1.11.3
CVE-2021-3518 High 8.8 CWE-416 0.00411 0.74648
  • 1.0.0–1.11.3
CVE-2021-3537 Medium 5.9 CWE-476 0.01401 0.86952
  • 1.0.0–1.11.3
CVE-2021-41098 High 7.5 CWE-611 0.00136 0.50339
  • 1.0.0–1.12.5
CVE-2022-23437 Medium 6.5 CWE-91 0.00451 0.75889
  • 1.0.0–1.13.3
CVE-2022-24836 High 7.5 CWE-1333, CWE-400 0.00909 0.83415
  • 1.0.0–1.13.3
CVE-2022-24839 High 7.5 CWE-400 0.00268 0.68512
  • 1.0.0–1.9.1
CVE-2022-29181 High 8.2 CWE-241 0.00368 0.73316
  • 1.0.0–1.13.5
CVE-2015-5312 High 7.1 CWE-399, CWE-400 0.00613 0.79335
  • 1.6.0–1.6.7.rc4
CVE-2015-7499 Medium 5 CWE-119, CWE-200, CWE-400 0.00247 0.65131
  • 1.6.0–1.6.7.1
CVE-2015-8806 High 7.5 CWE-94, CWE-119, CWE-400 0.02168 0.89745
  • 1.6.0–1.6.8.rc3
CVE-2015-1819 Medium 5 CWE-399, CWE-400 0.02489 0.90472
  • 1.6.6.1–1.6.6.3
CVE-2022-23476 High 7.5 CWE-476, CWE-252 0.00121 0.4786
  • 1.13.8–1.13.9

nokogiri Vulnerability Remediation Guidance

CVE Description Full list of Impacted Versions Fix
CVE-2022-29181 Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2022-24839 org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2022-24836 Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2022-23476 Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected. 1.13.8, 1.13.9 Patch → 1.13.10
CVE-2022-23437 There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2021-41098 Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2021-3537 A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2021-3518 There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2021-3517 There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2021-30560 Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2020-7595 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2020-26247 Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2019-5815 Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2019-5477 A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2019-20388 xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2019-18197 In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2019-13118 In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2019-13117 In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2019-11068 libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2018-8048 In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2018-25032 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2018-14404 A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-9050 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-9049 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-9048 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-9047 A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-7376 Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-7375 A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable). 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-5029 The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-18258 The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-16932 parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-15412 Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2017-0663 A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2016-4658 xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document. 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.5.11, 1.4.4, 1.6.8.1, 1.5.10 (Show all) Minor → 1.13.6
CVE-2015-8806 dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document. 1.6.7, 1.6.6.3, 1.6.5, 1.6.0, 1.6.7.rc3, 1.6.7.1, 1.6.7.2, 1.6.6.2 (Show all) Minor → 1.13.6
CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors. 1.6.7, 1.6.6.3, 1.6.5, 1.6.0, 1.6.7.rc3, 1.6.7.1, 1.6.6.2, 1.6.6.4 (Show all) Minor → 1.13.6
CVE-2015-5312 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660. 1.6.7, 1.6.6.3, 1.6.5, 1.6.0, 1.6.7.rc3, 1.6.6.2, 1.6.6.4, 1.6.7.rc4 (Show all) Minor → 1.13.6
CVE-2015-1819 The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack. 1.6.6.3, 1.6.6.2, 1.6.6.1 Patch → 1.13.6
CVE-2013-6461 Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.4.4, 1.5.10, 1.5.9, 1.5.6 (Show all) Minor → 1.13.6
CVE-2013-6460 Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.4.4, 1.5.10, 1.5.9, 1.5.6 (Show all) Minor → 1.13.6
CVE-2012-6685 Nokogiri before 1.5.4 is vulnerable to XXE attacks 1.5.2, 1.4.7, 1.5.0, 1.4.5, 1.4.4, 1.4.4.1, 1.5.3.rc5, 1.5.1.rc1 (Show all) Minor → 1.13.6

Instantly see if these nokogiri vulnerabilities affect your code.

Scan for Free

Dependencies

Packages using versions of nokogiri affected by its vulnerabilities

Dependent Packages
mini_portile2~> 2.8.2
racc~> 1.4