Executive brief
Nokogiri is a widely-used XML parsing library for Ruby applications. The library contains a flaw where XML canonicalization operations that should fail are silently returning empty strings instead. This allows applications that depend on Nokogiri for cryptographic signature validation—particularly SAML authentication systems—to incorrectly accept forged or tampered digital signatures, potentially enabling unauthorized access or account takeover.
Technical details
Nokogiri's CRuby extension implements the canonicalize() method for both Nokogiri::XML::Document and Nokogiri::XML::Node without checking the return value of the underlying xmlC14NExecute C library function. When canonicalization fails, the function returns an error code, but Nokogiri does not detect this and instead returns an empty string. This violates the principle of fail-secure error handling. An attacker can craft malformed XML that triggers canonicalization failure, causing Nokogiri to return an empty string that downstream libraries (particularly ruby-saml) may incorrectly interpret as a valid canonicalized form, bypassing SAML signature validation. The vulnerability requires network access to send a malicious SAML assertion and affects all CRuby versions from 1.5.1 through 1.19.0. The JRuby implementation is not affected as it correctly raises RuntimeError on failure. A fix is available in version 1.19.1.
Affected products
- Sparklemotion Nokogiri >= 1.5.1, < 1.19.1
Timeline
- 2026-02-18: disclosed: GitHub Advisory GHSA-wx95-c6cv-8532 published
- 2026-02-16: patched: Patch released in Nokogiri 1.19.1