CVE-2022-51000

Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via CVE-2022-23308 in libxml2, an application parsing an untrusted document with parse option DTDVALID set to true and NOENT set to false may be vulnerable to denial of service, memory disclosure, or code execution. Nokogiri 1.13.2 upgrades vendored libxml2 to 2.9.13 and libxslt to 1.1.35.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS probability

0.44%

CWE

CWE-416

Published

2026-08-25

Last modified

2026-09-08

Affected products

• sparklemotion nokogiri
• sparklemotion nokogiri

Weakness type

• CWE-416

Related vulnerabilities

• CVE-2026-87464 — Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outs
• CVE-2026-87646 — Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitr
• CVE-2026-87637 — Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbi
• CVE-2026-87634 — Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute
• CVE-2026-87609 — Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitra
• CVE-2026-87607 — Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially exec
• CVE-2026-87581 — Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeri
• CVE-2026-87558 — Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitr

Markdown version · Browse all CVEs