GCVE - cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Nokogiri (`978e9520-dade-5e37-bec5-059e1fdaac31`)
Product	Nokogiri (`e2c62fac-c61c-5701-871d-48aa8ee9ff17`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ruby-nokogiri`	purl2cpe	2026-06-01 10:14:49.377267
`pkg:deb/ubuntu/ruby-nokogiri`	purl2cpe	2026-06-01 10:14:49.377270
`pkg:gem/nokogiri`	purl2cpe	2026-06-01 10:14:49.377273
`pkg:github/sparklemotion/nokogiri`	purl2cpe	2026-06-01 10:14:49.377275
`pkg:rpm/fedora/rubygem-nokogiri`	purl2cpe	2026-06-01 10:14:49.377278
`pkg:rpm/opensuse/rubygem-nokogiri`	purl2cpe	2026-06-01 10:14:49.377281

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-79770`	vulnerable	2026-10-13 12:29:14.448146	Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer HIGH (7.5) Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service. Published: 2026-08-25T15:16:03.059Z Updated: 2026-09-16T15:51:27.061Z Open on db.gcve.eu Reference links https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5477`	vulnerable	2026-06-08 05:13:59.251824	Details available A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. Published: 2019-08-16T00:00:00.000Z Updated: 2024-08-04T19:54:53.581Z Open on db.gcve.eu Reference links https://hackerone.com/reports/650835 https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc https://github.com/sparklemotion/nokogiri/issues/1915 https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html https://usn.ubuntu.com/4175-1/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-6461`	vulnerable	2026-06-08 05:04:56.965237	Details available Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits Published: 2019-11-05T14:07:42.000Z Updated: 2024-08-06T17:39:01.356Z Open on db.gcve.eu Reference links https://security-tracker.debian.org/tracker/CVE-2013-6461 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461 https://access.redhat.com/security/cve/cve-2013-6461 http://www.openwall.com/lists/oss-security/2013/12/27/2 http://www.securityfocus.com/bid/64513	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-6460`	vulnerable	2026-06-08 05:04:56.960580	Details available Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents Published: 2019-11-05T14:02:54.000Z Updated: 2024-08-06T17:39:01.455Z Open on db.gcve.eu Reference links https://security-tracker.debian.org/tracker/CVE-2013-6460 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460 https://access.redhat.com/security/cve/cve-2013-6460 http://www.openwall.com/lists/oss-security/2013/12/27/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6685`	vulnerable	2026-06-08 05:03:01.553578	Details available Nokogiri before 1.5.4 is vulnerable to XXE attacks Published: 2020-02-19T14:41:27.000Z Updated: 2024-08-06T21:36:01.934Z Open on db.gcve.eu Reference links https://github.com/sparklemotion/nokogiri/issues/693 https://bugzilla.redhat.com/show_bug.cgi?id=1178970 https://nokogiri.org/CHANGELOG.html#154-2012-06-12	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Nokogiri

Notes

PURL mappings

Vulnerability references

Contribute