What’s Vulnerable › Vulnerabilities
CVE-2026-57234: Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
- Severity: low (CVSS 2.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-25 · updated 2026-10-25
- Weakness: CWE-178
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
Affected products
- sparklemotion nokogiri: before 1.19.4 — fixed in 1.19.4
- Rubygems Nokogiri: before 1.19.4; 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+188) — fixed in 1.19.4
How to fix
Upgrade to a fixed version: sparklemotion nokogiri 1.19.4; Rubygems Nokogiri 1.19.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-57234 or the next vulnerability affects your stack