Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 (sparklemotion nokogiri)
En bref
- Source
- NVD
- EPSS
- EPSS 0.20 % · centile 10 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
Faiblesses (CWE)
- CWE-178 — Gestion incorrecte de la casse
- CWE-184 — Liste d'entrées interdites incomplète
- CWE-611 — Entité externe XML (XXE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | LOW 2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N | GitHub_M |
| CVSS 3.1 | LOW 2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
Avis
- GHSA-8678-w3jw-xfc2 — Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
Références européennes
- ENISA EUVD · EUVD-2026-39421
- GCVE · GCVE-0-2026-57234
Avis du CERT-FR
- CERTFR-2026-AVI-1352 — Multiples vulnérabilités dans Oracle PeopleSoft · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*< 1.19.4
Produits affectés
| Produit | Versions |
|---|---|
| sparklemotion · nokogiri | affected < 1.19.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |