CVE-2020-26247

MEDIUM EPSS 61.8%
Published Dec 30, 20205y ago · Modified Jun 17, 20262w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Dec 30, 2020 5y ago
Last Modified Jun 17, 2026 2w ago

Description

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
61.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-611

Affected Products 6

VendorProductVersionRange
nokogirinokogiri* <1.11.0
nokogirinokogiri1.11.0any
nokogirinokogiri1.11.0any
nokogirinokogiri1.11.0any
debiandebian_linux9.0any
debiandebian_linux10.0any

References 8

  • github.com https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b
    PatchThird Party Advisory
  • github.com https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4
    Release NotesThird Party Advisory
  • github.com https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m
    MitigationThird Party Advisory
  • hackerone.com https://hackerone.com/reports/747489
    Permissions Required
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html
    Mailing ListThird Party Advisory
  • rubygems.org https://rubygems.org/gems/nokogiri
    ProductThird Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202208-29
    Third Party Advisory

Remediation

  • github.com https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b
    PatchThird Party Advisory