CVE-2026-57234 PUBLISHED

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

Assigner: GitHub_M
Reserved: 24.06.2026 Published: 25.06.2026 Updated: 25.06.2026

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS Score: 2.6

Product Status

Vendor sparklemotion
Product nokogiri
Versions
  • Version < 1.19.4 is affected

References

Problem Types

  • CWE-178: Improper Handling of Case Sensitivity CWE
  • CWE-184: Incomplete List of Disallowed Inputs CWE
  • CWE-611: Improper Restriction of XML External Entity Reference CWE