PT-2021-23087 · Ruby+1 · Nokogiri+1

Andrew Crewdson

·

Published

2021-09-27

·

Updated

2026-03-13

·

CVE-2021-41098

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Nokogiri versions 1.12.4 and earlier
Description Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser.
Recommendations For Nokogiri versions 1.12.4 and earlier, upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. As a temporary workaround, consider disabling the use of the SAX parser for untrusted documents until a patch is available. Restrict access to the vulnerable classes to minimize the risk of exploitation. Avoid using the affected classes to parse untrusted documents until the issue is resolved.

Exploit

Fix

XXE

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2025_16880
ALT-PU-2021-3484
ALT-PU-2023-4266
ALT-PU-2024-7812
CVE-2021-41098
GHSA-2RR5-8Q37-2W7H
OESA-2021-1396
OPENSUSE-SU-2024:11577-1
OPENSUSE-SU-2024:11912-1
OPENSUSE-SU-2024:13165-1
OPENSUSE-SU-2024:14174-1
OPENSUSE-SU-2025:14697-1
OPENSUSE-SU-2026:10356-1

Affected Products

Alt Linux
Nokogiri