CVE-2026-57234

LowCVSS 2.6/10Last modified Jun 26, 2026

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

Metrics

CVSS 3.1 2.6/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-178 CWE-184 CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-572358.2Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias CVE-2026-572368.2Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an inval CVE-2026-572377.8When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects refere CVE-2026-572387.8After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, whi CVE-2026-572397.8The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the oppor CVE-2026-57246.3The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are CVE-2026-572407.8When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulti CVE-2026-572416.1The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the CVE-2026-572427.8The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management CVE-2026-572436.1During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, wi CVE-2026-572447.8After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in t CVE-2026-572457.8When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal anno