Sparklemotion Nokogiri vulnerabilities

CVE-2026-79771 [MEDIUM] CWE-401 CVE-2026-79771: Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when p Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

CVE-2026-57438 [MEDIUM] CWE-416 CVE-2026-57438: Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each in place, freeing the include node along with its children (such as and its descendants) and any namespaces declared on them. If an application had already exposed one of

CVE-2026-57437 [MEDIUM] CWE-416 CVE-2026-57437: Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This

CVE-2023-28484 [MEDIUM] CWE-476 CVE-2023-28484: In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer derefere In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

CVE-2026-79769 [MEDIUM] CWE-843 CVE-2026-79769: Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protec Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it rea

CVE-2020-26247 [MEDIUM] CWE-611 CVE-2020-26247: Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector suppo Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This be

CVE-2025-6494 [LOW] CWE-119 CVE-2025-6494: A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the pub

CVE-2025-6490 [LOW] CWE-119 CVE-2025-6490: A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and cla A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public