Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 (sparklemotion nokogiri)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 10 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
Weaknesses (CWE)
- CWE-178 — Improper Handling of Case Sensitivity
- CWE-184 — Incomplete List of Disallowed Inputs
- CWE-611 — Improper Restriction of XML External Entity Reference
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N | GitHub_M |
| CVSS 3.1 | LOW 2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-8678-w3jw-xfc2 — Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
European references
- ENISA EUVD · EUVD-2026-39421
- GCVE · GCVE-0-2026-57234
CERT-FR advisories
- CERTFR-2026-AVI-1352 — Multiples vulnérabilités dans Oracle PeopleSoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*< 1.19.4
Affected products
| Product | Versions |
|---|---|
| sparklemotion · nokogiri | affected < 1.19.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |