# CVE-2026-126063: Nokogiri HTML5 serializer mutation XSS via noscript and attributes

Source: https://junglewise.ai/threats/cve-2026-126063-nokogiri-is-an-open-source-xml-and-html-library-for-the-ruby  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126063 · Severity: medium · CVSS 4 · Published 2026-11-10

Nokogiri is a Ruby library for parsing and manipulating XML and HTML documents. The HTML5 serializer in versions 1.12.0 to 1.19.4 fails to properly escape text inside noscript elements and angle brackets in attribute values, allowing attackers to inject executable markup when applications sanitize untrusted HTML and allow noscript elements. A scripting-enabled browser can parse markup that Nokogiri did not intend to produce, leading to mutation cross-site scripting attacks.

Technologies: [nokogiri (RubyGems)](https://junglewise.ai/threats/technologies/nokogiri). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems), [Sparklemotion](https://junglewise.ai/threats/vendors/sparklemotion).

## Quick answers

**Is CVE-2026-126063 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126063 being exploited in the wild.

**How severe is CVE-2026-126063?** Medium severity, with a CVSS score of 4, published 10 November 2026.

**Which products and versions are affected?** nokogiri (RubyGems) >= 1.12.0, < 1.19.5, ECOSYSTEM:introduced=1.12.0,fixed=1.19.5; Sparklemotion Nokogiri 1.12.0 to 1.19.4.

**Is there a fix for CVE-2026-126063?** Yes. nokogiri (RubyGems): upgrade to 1.19.5 or later. Until then: Use parse_noscript_content_as_text: true when parsing HTML, or remove noscript elements from sanitized HTML output before serialization. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126063 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126063?** Check whether you run nokogiri (RubyGems) or Sparklemotion Nokogiri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nokogiri (RubyGems): upgrade to 1.19.5 or later

  ```sh
  bundle update nokogiri
  ```


Use parse_noscript_content_as_text: true when parsing HTML, or remove noscript elements from sanitized HTML output before serialization.

## Technical details

The vulnerability exists in Nokogiri's HTML5 serializer, which emits text inside noscript elements literally despite the default parsing mode treating noscript content as markup rather than text. This mismatch allows attackers to craft input like &lt;noscript&gt;&amp;lt;img src=x onerror=alert(1)&amp;gt;&lt;/noscript&gt; that parses into an early end tag followed by executable markup. The issue affects the C extension on CRuby and TruffleRuby; JRuby is unaffected. The fix ensures noscript text is only emitted literally when the document was explicitly parsed with parse_noscript_content_as_text: true.

## Affected products

- Sparklemotion Nokogiri 1.12.0 to 1.19.4

## Identifiers

- CVE-2026-126063
- GHSA-4p39-36wj-23h4

## Timeline

- 2026-11-10: disclosed: CVE-2026-126063 published
- 2026-11-01: patched: Fix committed to repository

## References

- [https://github.com/sparklemotion/nokogiri/commit/3e84df6ff7ab4d78f446e3a415430bd69a055d32](https://github.com/sparklemotion/nokogiri/commit/3e84df6ff7ab4d78f446e3a415430bd69a055d32)
- [https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8](https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8)

## Related threats

- [Nokogiri use-after-free in attribute replacement](https://junglewise.ai/threats/cve-2026-126064-nokogiri-is-an-open-source-xml-and-html-library-for-the-ruby)
- [JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host](https://junglewise.ai/threats/cve-2026-126062-nokogiri-is-an-open-source-xml-and-html-library-for-the-ruby)
- [Nokogiri unchecked return value in canonicalize method](https://junglewise.ai/threats/nokogiri-unchecked-return-value-in-canonicalize-method-3863de91)
- [Nokogiri XSLT transform memory leak](https://junglewise.ai/threats/nokogiri-xslt-transform-memory-leak-0441ddf7)
- [Nokogiri CSS selector tokenizer ReDoS](https://junglewise.ai/threats/nokogiri-css-selector-tokenizer-redos-d52ae203)