Nokogiri 1.11.0 Release Candidate 1 for Ruby

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:nokogiri:nokogiri:1.11.0:rc1:*:*:*:ruby:*:*

part: a version: 1.11.0 update: rc1

VendorNokogiri (978e9520-dade-5e37-bec5-059e1fdaac31)
ProductNokogiri (e2c62fac-c61c-5701-871d-48aa8ee9ff17)
Edition*
Language*
Software edition*
Target softwareruby
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/ruby-nokogiri purl2cpe 2026-06-01 10:14:49.377578
pkg:deb/ubuntu/ruby-nokogiri purl2cpe 2026-06-01 10:14:49.377580
pkg:gem/nokogiri purl2cpe 2026-06-01 10:14:49.377581
pkg:github/sparklemotion/nokogiri purl2cpe 2026-06-01 10:14:49.377582
pkg:rpm/fedora/rubygem-nokogiri purl2cpe 2026-06-01 10:14:49.377584
pkg:rpm/opensuse/rubygem-nokogiri purl2cpe 2026-06-01 10:14:49.377585

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-26247 vulnerable 2026-06-08 05:23:50.962252 XXE in Nokogiri
LOW (2.6)
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
Published: 2020-12-30T00:00:00.000Z
Updated: 2024-08-04T15:56:04.939Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.