Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-nokogiri | Aug 22, 2024 | May 20, 2022 |
| Amazon_linux | — | Upgrade rubygem-nokogiri | Dec 10, 2022 | May 20, 2022 |
| Apple Osx Accounts | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Amd | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Applemobilefileintegrity | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Bluetooth | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Bootcamp | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Coreservices | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Curl | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Driverkit | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Dyld | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Icloudphotolibrary | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Imageio | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Iohidfamily | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Iomobileframebuffer | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Itunesstore | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Kernel | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Networking | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Packagekit | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Photos | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Ppp | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Preferences | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Printing | — | — | Oct 14, 2024 | May 20, 2022 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Jan 10, 2023 | May 20, 2022 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-gssapiUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade python39-pulp_manifestUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cliUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-little-pluggerUpgrade satellite-maintainUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-localeUpgrade rubygem-fast_gettextUpgrade rubygem-domain_nameUpgrade rubygem-jwtUpgrade satellite-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffiUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cloneUpgrade rubygem-apipie-bindings | Sep 25, 2023 | May 20, 2022 |
| Debian | — | Upgrade ruby-nokogiri | Jul 30, 2024 | May 20, 2022 |
| Gentoo Linux | — | Upgrade dev-ruby/nokogiri. | Aug 16, 2022 | May 20, 2022 |
| Redhat_linux | — | Upgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade rubygem-hashieUpgrade rubygem-highlineUpgrade rubygem-http-cookieUpgrade rubygem-unfUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-display_widthUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-jwtUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-gssapiUpgrade satellite-maintainUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-loggingUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffiUpgrade satellite-cloneUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-fast_gettextUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-mime-typesUpgrade rubygem-netrc | Sep 25, 2023 | May 20, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-nokogiri-docUpgrade ruby2.5-rubygem-nokogiri-testsuiteUpgrade ruby2.5-rubygem-nokogiri | Nov 17, 2022 | May 20, 2022 |
| Ubuntu | — | Upgrade ruby-nokogiri (Ubuntu Pro) | Jun 26, 2025 | May 20, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 20, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub