Is CVE-2026-126063 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126063 being exploited in the wild.

How severe is CVE-2026-126063?

Medium severity, with a CVSS score of 4, published 10 November 2026.

Which products and versions are affected?

nokogiri (RubyGems) >= 1.12.0, < 1.19.5, ECOSYSTEM:introduced=1.12.0,fixed=1.19.5; Sparklemotion Nokogiri 1.12.0 to 1.19.4.

How is CVE-2026-126063 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126063?

Check whether you run nokogiri (RubyGems) or Sparklemotion Nokogiri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126063: Nokogiri HTML5 serializer mutation XSS via noscript and attributes

Q: Is there a fix for CVE-2026-126063?

Yes. nokogiri (RubyGems): upgrade to 1.19.5 or later. Until then: Use parse_noscript_content_as_text: true when parsing HTML, or remove noscript elements from sanitized HTML output before serialization. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126063 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126063?

Check whether you run nokogiri (RubyGems) or Sparklemotion Nokogiri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126063 · Severity: medium · CVSS 4 · Published 2026-11-10

Nokogiri is a Ruby library for parsing and manipulating XML and HTML documents. The HTML5 serializer in versions 1.12.0 to 1.19.4 fails to properly escape text inside noscript elements and angle brackets in attribute values, allowing attackers to inject executable markup when applications sanitize untrusted HTML and allow noscript elements. A scripting-enabled browser can parse markup that Nokogiri did not intend to produce, leading to mutation cross-site scripting attacks.

Technologies: nokogiri (RubyGems). Vendors: RubyGems, Sparklemotion.

Quick answers

Is CVE-2026-126063 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126063 being exploited in the wild.
How severe is CVE-2026-126063?: Medium severity, with a CVSS score of 4, published 10 November 2026.
Which products and versions are affected?: nokogiri (RubyGems) >= 1.12.0, < 1.19.5, ECOSYSTEM:introduced=1.12.0,fixed=1.19.5; Sparklemotion Nokogiri 1.12.0 to 1.19.4.
Is there a fix for CVE-2026-126063?: Yes. nokogiri (RubyGems): upgrade to 1.19.5 or later. Until then: Use parse_noscript_content_as_text: true when parsing HTML, or remove noscript elements from sanitized HTML output before serialization. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126063 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126063?: Check whether you run nokogiri (RubyGems) or Sparklemotion Nokogiri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nokogiri (RubyGems): upgrade to 1.19.5 or later
```
bundle update nokogiri
```

Use parse_noscript_content_as_text: true when parsing HTML, or remove noscript elements from sanitized HTML output before serialization.

Technical details

The vulnerability exists in Nokogiri's HTML5 serializer, which emits text inside noscript elements literally despite the default parsing mode treating noscript content as markup rather than text. This mismatch allows attackers to craft input like <noscript>&lt;img src=x onerror=alert(1)&gt;</noscript> that parses into an early end tag followed by executable markup. The issue affects the C extension on CRuby and TruffleRuby; JRuby is unaffected. The fix ensures noscript text is only emitted literally when the document was explicitly parsed with parse_noscript_content_as_text: true.

Affected products

Sparklemotion Nokogiri 1.12.0 to 1.19.4

Identifiers

CVE-2026-126063
GHSA-4p39-36wj-23h4

Timeline

2026-11-10: disclosed: CVE-2026-126063 published
2026-11-01: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.