CVE-2026-57234
LOWNokogiri JRuby < 1.19.4 - NONET Bypass Allows Network Requests
Title source: manualDescription
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
References (1)
Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2
Scores
CVSS v3
2.6
EPSS
0.0017
EPSS Percentile
6.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-178
CWE-184
CWE-611
Status
published
Products (2)
nokogiri/nokogiri
< 1.19.4
sparklemotion/nokogiri
< 1.19.4
Published
Jun 25, 2026
Tracked Since
Jun 25, 2026