CVE-2022-29181
published 2022-05-20CVE-2022-29181: Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers…
PriorityP346high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
EPSS
3.08%
86.2th percentile
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | >= 13.0 < 13.1 | 13.1 |
| apple | macos_ventura | — | — |
| debian | ruby-nokogiri | < ruby-nokogiri 1.13.7+dfsg-1 (bookworm) | ruby-nokogiri 1.13.7+dfsg-1 (bookworm) |
| nokogiri | nokogiri | < 1.13.6 | 1.13.6 |
| nokogiri | nokogiri | >= 0 < 1.13.6 | 1.13.6 |
| sparklemotion | nokogiri | < 1.13.6 | 1.13.6 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv8.2HIGH
vendor_debian8.2LOW
vendor_redhat8.2HIGH
vendor_ubuntu2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ruby-nokogiri vulnerabilities
osv·2025-07-21·CVSS 4.3
CVE-2020-26247 [MEDIUM] ruby-nokogiri vulnerabilities
ruby-nokogiri vulnerabilities
It was discovered Nokogiri did not correctly parse XML Schemas.
If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-26247)
Agustin Gianni discovered that Nokogiri did not correctly parse
XML and HTML files. If a user or automated system were tricked into
opening a specially crafted file, an attacker could possibly use this
issue to cause a denial of service or leak sensitive information.
(CVE-2022-29181)
GHSA
Nokogiri Improperly Handles Unexpected Data Type
ghsa·2022-05-23
CVE-2022-29181 [HIGH] CWE-241 Nokogiri Improperly Handles Unexpected Data Type
Nokogiri Improperly Handles Unexpected Data Type
### Summary
Nokogiri `= 1.13.6`.
JRuby users are not affected.
### Workarounds
To avoid this vulnerability in affected applications, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
### Credit
This vulnerability was responsibly reported by @agustingianni and the Github Security Lab.
OSV
Nokogiri Improperly Handles Unexpected Data Type
osv·2022-05-23
CVE-2022-29181 [HIGH] Nokogiri Improperly Handles Unexpected Data Type
Nokogiri Improperly Handles Unexpected Data Type
### Summary
Nokogiri `= 1.13.6`.
JRuby users are not affected.
### Workarounds
To avoid this vulnerability in affected applications, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
### Credit
This vulnerability was responsibly reported by @agustingianni and the Github Security Lab.
OSV
CVE-2022-29181: Nokogiri is an open source XML and HTML library for Ruby
osv·2022-05-20·CVSS 8.2
CVE-2022-29181 [HIGH] CVE-2022-29181: Nokogiri is an open source XML and HTML library for Ruby
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
Ubuntu
Nokogiri vulnerabilities
vendor_ubuntu·2025-07-21·CVSS 2.6
CVE-2022-40303 [LOW] Nokogiri vulnerabilities
Title: Nokogiri vulnerabilities
Summary: Several security issues were fixed in Nokogiri.
It was discovered Nokogiri did not correctly parse XML Schemas.
If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-26247)
Agustin Gianni discovered that Nokogiri did not correctly parse
XML and HTML files. If a user or automated system were tricked into
opening a specially crafted file, an attacker could possibly use this
issue to cause a denial of service or leak sensitive information.
(CVE-2022-29181)
Instructions: In general, a standard system update will make all the necessary changes.
Apple
CVE-2022-29181: macOS Ventura 13.1
vendor_apple·2022-12-13·CVSS 8.2
CVE-2022-29181 [HIGH] CVE-2022-29181: macOS Ventura 13.1
Apple Security Update: About the security content of macOS Ventura 13.1
Product: macOS Ventura
Version: 13.1
CVE: CVE-2022-29181
Component: CVE-2022-29181
Red Hat
rubygem-nokogiri: Improper Handling of Unexpected Data Type in Nokogiri
vendor_redhat·2022-05-19·CVSS 8.2
CVE-2022-29181 [HIGH] CWE-241 rubygem-nokogiri: Improper Handling of Unexpected Data Type in Nokogiri
rubygem-nokogiri: Improper Handling of Unexpected Data Type in Nokogiri
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
A flaw was found in the rubygem-nokogiri package. This flaw allows malicious users to change partial contents or configurations on the system. Additionally, this vulnerability can also cause a limited denial of service in the form of interruptions in resource availability.
Statement: Red Hat Satellite
Debian
CVE-2022-29181: ruby-nokogiri - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to vers...
vendor_debian·2022·CVSS 8.2
CVE-2022-29181 [HIGH] CVE-2022-29181: ruby-nokogiri - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to vers...
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
Scope: local
bookworm: resolved (fixed in 1.13.7+dfsg-1)
bullseye: open
forky: resolved (fixed in 1.13.7+dfsg-1)
sid: resolved (fixed in 1.13.7+dfsg-1)
trixie: resolved (fixed in 1.13.7+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8mhttps://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogirihttp://seclists.org/fulldisclosure/2022/Dec/23https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8mhttps://security.gentoo.org/glsa/202208-29https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri/https://support.apple.com/kb/HT213532
2022-05-20
Published