CVE-2026-126062
3.7 LOWpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-611, CWE-918
Public exploit & PoC references
- https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8
- https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac
- https://github.com/sparklemotion/nokogiri/pull/3752
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm
All references
- https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8
- https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac
- https://github.com/sparklemotion/nokogiri/pull/3752
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2020-37278PoC
- HIGHCVE-2023-54402PoC
- MEDIUMCVE-2024-34319
- HIGHCVE-2025-14260
- UNSCOREDCVE-2026-0311
- LOWCVE-2026-100104
- HIGHCVE-2026-10025
- MEDIUMCVE-2026-100251
Related by shared AI tags and CWE weakness class. Browse the full archive.