[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
nokogiri (source, changelog)	1.19.4 → 1.19.5

---

Nokogiri: Mutation XSS through noscript content in Nokogiri's HTML5 serializer

CVE-2026-126063 / GHSA-4p39-36wj-23h4

More information

Details

Summary

Nokogiri's HTML5 serializer did not escape text inside noscript elements, or < and > inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.

Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parse_noscript_content_as_text: true.

Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5.

Severity

The Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). Exploitation requires an application that allows noscript in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.

Mitigation

Upgrade to Nokogiri 1.19.5 or later.

Applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true (available since Nokogiri 1.17.0), or remove noscript elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside noscript is serialized unchanged, as the standard requires.

Credit

This issue was responsibly reported by @​a-zara-n.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4
• https://github.com/sparklemotion/nokogiri/pull/3752
• https://github.com/sparklemotion/nokogiri/commit/3e84df6ff7ab4d78f446e3a415430bd69a055d32
• https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-4p39-36wj-23h4.yml
• https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5
• https://github.com/advisories/GHSA-4p39-36wj-23h4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value

CVE-2026-126064 / GHSA-3w22-6jfg-527w

More information

Details

Summary

Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.

This is the same class of issue as GHSA-phwj-rprq-35pp, which was fixed for Attr#value= in Nokogiri 1.19.4.

Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.

JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via Node#[]= or Node#lang=. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.

Mitigation

Upgrade to Nokogiri 1.19.5 or later.

As a workaround, avoid accessing attribute child nodes directly via Attr#children or similar before replacing the same attribute's value.

Credit

This issue was responsibly reported by zx (@​manus-pi).

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w
• https://github.com/sparklemotion/nokogiri/pull/3752
• https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425
• https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-3w22-6jfg-527w.yml
• https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5
• https://github.com/advisories/GHSA-3w22-6jfg-527w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host

CVE-2026-126062 / GHSA-v995-44v6-5fqm

More information

Details

Summary

On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF.

Nokogiri 1.19.5 applies the XML::Schema check from GHSA-8678-w3jw-xfc2: with NONET set, only local resources are loaded.

Only JRuby is affected. Default parse options are not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity.

Mitigation

Upgrade to Nokogiri 1.19.5 or later, or do not enable DTDLOAD, DTDVALID or NOENT for untrusted input.

Credit

This issue was responsibly reported by @​arpitjain099.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm
• https://github.com/sparklemotion/nokogiri/pull/3752
• https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8
• https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-v995-44v6-5fqm.yml
• https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5
• https://github.com/advisories/GHSA-v995-44v6-5fqm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sparklemotion/nokogiri (nokogiri)

v1.19.5

Compare Source

Security

• [CRuby] (Low) Fixed a possible use-after-free when an attribute value is replaced via Node#[]= or Node#lang= while Ruby objects still reference the attribute's children. See GHSA-3w22-6jfg-527w for more information.
• [CRuby] (Low) The HTML5 serializer now escapes text inside noscript unless the document was parsed with parse_noscript_content_as_text: true, preventing a mutation XSS in applications that allow noscript in sanitized HTML. A fragment now parses noscript content the same way as its document, and raises ArgumentError if given a conflicting parse_noscript_content_as_text: value. Comments and raw-text elements inside noscript are still serialized unchanged, as the HTML standard requires, so applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true or remove noscript elements. See GHSA-4p39-36wj-23h4 for more information.
• [JRuby] (Low) NONET now blocks external DTDs and entities whose systemId uses a short-form IPv4 host such as 127.1, or is an absolute path in a document parsed from a network URL. Previously Nokogiri fetched them over the network during a parse with DTDLOAD or NOENT, potentially enabling SSRF. See GHSA-v995-44v6-5fqm for more information.

Improved

• [CRuby] The HTML5 parser now has linear performance when parsing many attributes. Previously performance was quadratic due to two hotspots, one in detecting duplicate attributes and one in constructing the libxml2 data structures. (#​3393) @​flavorjones
• [CRuby] Improved XPath argument marshalling performance by using ALLOCV_N instead of rb_gc_register_address. (#​3648) @​jhawthorn

Fixed

• Node#namespace= now declares the namespace on the node when no declaration of its prefix is in scope there. Previously, on CRuby, a node given a namespace and then moved under an element that binds the same prefix, or the default namespace, to a different URI was serialized in that other namespace. On JRuby, the namespace was missing from Node#namespace_definitions. (#​3459, #​3462) @​flavorjones
• XML::Reader is no longer affected by changes made to its source String after the reader is created. Previously, such a change could make the reader parse the changed String on JRuby, or changed or freed memory on CRuby with libxml2 < 2.11. (#​3694) @​flavorjones
• Node#namespace = false now raises TypeError. Previously it crashed the process on CRuby and raised ClassCastException on JRuby. (#​3719) @​flavorjones
• XML::XPathContext.new and XML::XPathContext#node= raise TypeError when the argument is not a Node. Previously, on CRuby, most such arguments crashed the process. (#​3720) @​flavorjones
• CSS an+b selectors with a zero or negative step now follow the Selectors spec: :nth-child(0n+3) matches only the third element (previously nothing), 0n-1 matches nothing instead of raising ZeroDivisionError, and -n+0 / -2n match nothing instead of every (or every other) element. @​afurm
• CSS #id, .class and attribute selectors whose value contains a quote character, such as #it\'s or [a=\'b\'], now match that value. Previously they raised Nokogiri::XML::XPath::SyntaxError or generated an XPath query with a different meaning. An #id selector containing an escaped newline no longer drops the text after it. (#​3724, #​3727) @​flavorjones
• CSS :contains() arguments, custom pseudo-class string arguments, and element names containing a CSS escape, such as p:contains('it\'s') or a\-b, now match. Previously they raised Nokogiri::XML::XPath::SyntaxError. An element name that is not an XML name after unescaping, such as a\!b, raises Nokogiri::CSS::SyntaxError, except as an unprefixed name in an HTML5 document, where it matches by local name. In ids, classes, attribute values, element names and string arguments, an escape for U+0000, a surrogate, or a code point above U+10FFFF now decodes to U+FFFD, and a vertical tab after a hexadecimal escape is no longer dropped, as CSS Syntax Level 3 requires. (#​3728, #​3729) @​flavorjones
• CSS attribute names containing a CSS escape, such as [a\-b], now match. Previously they raised Nokogiri::XML::XPath::SyntaxError. An unprefixed attribute name that cannot be written as an XPath name test after unescaping, such as [\@click] or [\:class], matches an attribute with that exact name in no namespace. The HTML parsers create such attributes. A prefixed one, such as [x|a\!b], raises Nokogiri::CSS::SyntaxError. (#​3732, #​3735) @​flavorjones
• [CRuby] The HTML5 serializer escapes < and > in attribute values as < and >, following whatwg/html#6362. Previously they were written literally. (#​3529, #​3741) @​flavorjones
• [CRuby] Reparenting removes a node's declaration of a prefix that the new parent binds to the same URI. (#​3462) @​flavorjones
• [CRuby] Builder now correctly builds namespaced nodes that define their own namespace when that ns prefix collides with one defined by the parent (or another ancestor). (#​3458, #​3461) @​flavorjones
• [CRuby] Reader.outer_xml and .inner_xml properly capture syntax errors. (#​3558) @​flavorjones
• [CRuby] XML::SAX::PushParser and HTML4::SAX::PushParser keep parsing correctly after GC compaction relocates their SAX parser. (#​3665) @​zanker
• [CRuby] XML::Reader keeps reading correctly when GC compaction runs. Previously, compaction could move the IO or String the reader was created from, and the reader then crashed or parsed the wrong bytes. (#​3666, #​3668) @​zanker
• [CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly when GC compaction runs. Previously, after compaction moved a stylesheet that uses an extension module, a later transform raised an exception or crashed. (#​3667) @​jeremy
• [CRuby] XSLT::Stylesheet#transform passes the correct params when GC compaction runs while it converts a param with #to_str. Previously, compaction could move the bytes of earlier short params, and the transform raised RuntimeError or silently left a param empty. (#​3670) @​flavorjones
• [CRuby] XML::SAX::ParserContext.io and HTML4::SAX::ParserContext.io keep parsing correctly after GC compaction relocates the IO. (#​3669) @​zanker
• [CRuby] Document#canonicalize passes the correct inclusive namespace prefixes when it converts a prefix with #to_str, and when GC compaction runs during canonicalization. Previously, libxml2 could read freed or moved memory, and the output lost namespaces or Ruby crashed. Raising on a prefix with a null byte also no longer leaks memory. (#​3714, #​3750) @​Priyank-gouda678 @​flavorjones
• [CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly when GC compaction runs during the transform. Previously, compaction could move an extension handler instance, and a later call to one of its functions raised an exception or crashed. (#​3748) @​flavorjones
• [CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly after an extension function runs another transform with the same stylesheet, or while another thread does. Previously, the inner or concurrent transform released extension handler instances that the other transform still used, and GC could free them. (#​3748) @​flavorjones
• [CRuby] XML::Reader.from_memory accepts an object that responds to to_str. Previously, it could raise Nokogiri::XML::SyntaxError. (#​3694) @​flavorjones
• [CRuby] XPathContext#evaluate no longer leaks memory when a custom XPath function handler raises an exception. (#​3715, #​1610) @​flavorjones
• [CRuby] When a custom XPath function handler raises an exception, XPathContext#evaluate now resets libxml2's error handlers and unregisters the custom function lookup. Previously, libxml2 could keep references to garbage-collected Ruby objects. (#​3715) @​flavorjones
• [CRuby MacOS] Fixed an issue handling SIGINT during HTML5 parsing. (#​3528, #​3535) @​stevecheckoway
• [CRuby] gumbo: gumbo_parse_with_options no longer crashes when stop_on_first_error is set and the parse ends on an unknown end tag in a fragment context. This is a C API path; it is not reachable from Ruby, because Nokogiri never sets stop_on_first_error. (#​3672) @​jeremy
• [JRuby] Fixed multiple issues with Node#namespace_definitions so that it now behaves identically to CRuby. (#​2543, #​3460) @​flavorjones
• [CRuby] HTML5 fragment parsing raises TypeError when the context node or one of its ancestors is an element whose name returns something other than a String. Previously this could crash the process. (#​3740) @​flavorjones
• [CRuby] HTML5 parsing no longer leaks memory when a comment follows </body> and a <frameset> start tag follows the comment. (#​3744) @​flavorjones
• [CRuby] An XSLT extension function that raises an exception no longer leaks memory or leaves behind a stale libxml2 error handler, which could write into a freed Ruby object. (#​3718, #​3721) @​Priyank-gouda678 @​flavorjones
• [CRuby] When an IO's read raises an exception that is not a StandardError, such as Interrupt or Timeout::ExitException, parsing with XML::Document, HTML4::Document or XML::Reader no longer leaks memory or leaves behind a stale libxml2 error handler. (#​3718, #​3721) @​Priyank-gouda678 @​flavorjones
• [CRuby] Nokogiri compiles on 64-bit Windows with Ruby 4.1, which stores String and Array lengths in the new rb_len_t type. Previously compilation failed with an incompatible pointer type error in xml_node_set.c. (#​3711) @​larskanis
• [CRuby] Node#line= now raises NoMethodError on Document, DTD, Attr, ElementDecl, AttributeDecl and EntityDecl, as #line already does on all of them except Attr. Previously it wrote past the end of the node's memory or overwrote an unrelated field, which could crash the process. (#​3737, #​3738) @​Priyank-gouda678 @​flavorjones
• [JRuby] Document#create_element and Node.new no longer set the namespace to the document's default namespace. The namespace must be set explicitly with namespace= or by parenting the node. (#​3457, #​3463) @​flavorjones
• [JRuby] XPath queries work when Xalan is loaded by a parent of the JRuby class loader and the thread's context class loader is that parent, as in a servlet container with Xalan in WEB-INF/lib. Previously they raised DTMConfigurationException: No default implementation found. Nokogiri also no longer sets the JVM-wide system property org.apache.xml.dtm.DTMManager, which made XSLT transformations and other Xalan users in the same JVM fail in that setup. (#​3707) @​flavorjones

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dpebot]

/gcbrun

[gemini-code-assist]

Code Review

This pull request updates the nokogiri gem dependency in Gemfile.lock from version 1.19.4 to 1.19.7. I have no feedback to provide as there are no review comments or issues identified.

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun