Executive brief
Nokogiri is a popular library used by Ruby developers to process and read XML and HTML data. In certain configurations using JRuby, the library fails to block unauthorized network requests when processing XML schemas, even when security protections are enabled. This could allow an attacker to trick the system into fetching internal data or connecting to unintended external servers, potentially leading to data exposure.
Technical details
A vulnerability exists in Nokogiri's JRuby implementation where the NONET parse option is not correctly enforced for Nokogiri::XML::Schema. While Nokogiri enables NONET by default to prevent network access during parsing, the JRuby implementation used an incomplete denylist for schemes that could be bypassed (e.g., via case-sensitivity issues). This allows a specially crafted XML schema to trigger external resource fetching. The fix in version 1.19.4 replaces the scheme denylist with a strict allowlist that only permits local file resources when NONET is enabled. CRuby implementations are unaffected as they rely on libxml2's native I/O layer protections.
Affected products
- sparklemotion Nokogiri < 1.19.4
Timeline
- 2026-06-18: advisory: GitHub security advisory published
- 2026-06-25: disclosed: CVE published to NVD
- 2026-06-25: patched: Fixed in version 1.19.4