CVE-2026-57234 Details
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
A vulnerability exists in the Nokogiri library for Ruby, specifically in the JRuby implementation, prior to version 1.19.4. The issue arises because the NONET parse option, which is enabled by default for Nokogiri::XML::Schema, was not properly enforced in JRuby. This lack of enforcement allowed schemas to be parsed with default options that could fetch external resources over the network, potentially leading to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks. In contrast, the CRuby implementation is not affected, as it blocks all network schemes at the I/O layer regardless of scheme or case.
Users are advised to upgrade to Nokogiri version 1.19.4 or later. After upgrading, the NONET option will be correctly enforced in JRuby, blocking all network schemes and only allowing local resources to be accessed. If external resource access is needed for trusted input, the NONET option can be explicitly disabled by passing a Nokogiri::XML::ParseOptions object with the NONET flag turned off.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-611 | Improper Restriction of XML External Entity Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nokogiri nokogiri | < 1.19.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |