CVE-2020-26247
published 2020-12-30CVE-2020-26247: Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
1.11%
62.4th percentile
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | ruby-nokogiri | < ruby-nokogiri 1.11.1+dfsg-1 (bookworm) | ruby-nokogiri 1.11.1+dfsg-1 (bookworm) |
| nokogiri | nokogiri | < 1.19.4 | 1.19.4 |
| nokogiri | nokogiri | < 1.11.0 | 1.11.0 |
| nokogiri | nokogiri | — | — |
| nokogiri | nokogiri | >= 0 < 1.19.4 | 1.19.4 |
| nokogiri | nokogiri | >= 0 < 1.11.0 | 1.11.0 |
| sparklemotion | nokogiri | < 1.19.4 | 1.19.4 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
ghsa4.3MEDIUM
osv4.3MEDIUM
vendor_debian2.6LOW
vendor_redhat2.6LOW
vendor_ubuntu2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
ghsa·2026-06-19·CVSS 4.3
CVE-2020-26247 [MEDIUM] CWE-178 Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
### Summary
The `NONET` parse option, which Nokogiri turns on by default for `Nokogiri::XML::Schema` (see [CVE-2020-26247](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m)), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks.
Nokogiri 1.19.4 replaces the scheme denylist with an allowlist. When `NONET` is enabled, only local resources (a `file:` scheme, or a relative or absolute path with no scheme) are resolved, and every network scheme is blocked, case-insensitively. This brings the JRuby beha
OSV
ruby-nokogiri vulnerabilities
osv·2025-07-21·CVSS 4.3
CVE-2020-26247 [MEDIUM] ruby-nokogiri vulnerabilities
ruby-nokogiri vulnerabilities
It was discovered Nokogiri did not correctly parse XML Schemas.
If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-26247)
Agustin Gianni discovered that Nokogiri did not correctly parse
XML and HTML files. If a user or automated system were tricked into
opening a specially crafted file, an attacker could possibly use this
issue to cause a denial of service or leak sensitive information.
(CVE-2022-29181)
GHSA
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
ghsa·2020-12-30
CVE-2020-26247 [MEDIUM] CWE-611 Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
### Severity
Nokogiri maintainers have evaluated this as [__Low Severity__ (CVSS3 2.6)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).
### Description
In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by `Nokogiri::XML::Schema` are **trusted** by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.
This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as **untrusted** by default whenever possible.
Please note that this security fix was pushed into a new minor version, 1.11.x, rather than a patch release to the 1.10.x branch, because it is a br
OSV
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
osv·2020-12-30
CVE-2020-26247 [MEDIUM] Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
### Severity
Nokogiri maintainers have evaluated this as [__Low Severity__ (CVSS3 2.6)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).
### Description
In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by `Nokogiri::XML::Schema` are **trusted** by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.
This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as **untrusted** by default whenever possible.
Please note that this security fix was pushed into a new minor version, 1.11.x, rather than a patch release to the 1.10.x branch, because it is a br
OSV
CVE-2020-26247: Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support
osv·2020-12-30·CVSS 4.3
CVE-2020-26247 [MEDIUM] CVE-2020-26247: Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
Ubuntu
Nokogiri vulnerabilities
vendor_ubuntu·2025-07-21·CVSS 2.6
CVE-2022-40303 [LOW] Nokogiri vulnerabilities
Title: Nokogiri vulnerabilities
Summary: Several security issues were fixed in Nokogiri.
It was discovered Nokogiri did not correctly parse XML Schemas.
If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-26247)
Agustin Gianni discovered that Nokogiri did not correctly parse
XML and HTML files. If a user or automated system were tricked into
opening a specially crafted file, an attacker could possibly use this
issue to cause a denial of service or leak sensitive information.
(CVE-2022-29181)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema
vendor_redhat·2020-12-30·CVSS 2.6
CVE-2020-26247 [LOW] CWE-611 rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema
rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
A flaw was found in Nokogiri. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling X
Debian
CVE-2020-26247: ruby-nokogiri - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath an...
vendor_debian·2020·CVSS 2.6
CVE-2020-26247 [LOW] CVE-2020-26247: ruby-nokogiri - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath an...
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
Scope: local
bookworm: resolved (fixed in 1.11.1+dfsg-1)
bullseye: resolved (fixed in 1.11.1+dfsg-1)
forky: resolved (fixed in 1.11.1+dfsg-1)
sid: resolved (fixed in 1.11.1+dfsg-1)
trixie: resolved (fixed in 1.11.1+dfsg-1)
No detection rules found.
No public exploits indexed.
https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97bhttps://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54mhttps://hackerone.com/reports/747489https://lists.debian.org/debian-lts-announce/2021/06/msg00007.htmlhttps://lists.debian.org/debian-lts-announce/2022/10/msg00018.htmlhttps://rubygems.org/gems/nokogirihttps://security.gentoo.org/glsa/202208-29https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97bhttps://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54mhttps://hackerone.com/reports/747489https://lists.debian.org/debian-lts-announce/2021/06/msg00007.htmlhttps://lists.debian.org/debian-lts-announce/2022/10/msg00018.htmlhttps://rubygems.org/gems/nokogirihttps://security.gentoo.org/glsa/202208-29
2020-12-30
Published