VULNERABILITY INTELLIGENCE

CVE-2026-57234

CVSS score2.6 LOW
EPSS probability0.20%
CISA KEVNot currently listed
Published2026-06-25
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

Weakness classification

  • CWE-178: Improper Handling of Case Sensitivity
  • CWE-184: Incomplete List of Disallowed Inputs
  • CWE-611: Improper Restriction of XML External Entity Reference

Primary references