CVE-2026-57234

2.6 Faible

Publiée le 25/06/2026 à 17:16 · Modifiée le 26/06/2026 à 21:03 · Analysée par le NVD · Source : security-advisories@github.com

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

Traduire en français

Produits concernés

sparklemotion nokogiri
Nokogiri nokogiri

Scores CVSS

Version	Score	Source	Vecteur
3.1	2.6 Faible	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-178
CWE-184
CWE-611

Références

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories