Nokogiri 1.11.0 Release Candidate 2 for Ruby

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:nokogiri:nokogiri:1.11.0:rc2:*:*:*:ruby:*:*

part: a version: 1.11.0 update: rc2

VendorNokogiri (978e9520-dade-5e37-bec5-059e1fdaac31)
ProductNokogiri (e2c62fac-c61c-5701-871d-48aa8ee9ff17)
Edition*
Language*
Software edition*
Target softwareruby
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/ruby-nokogiri purl2cpe 2026-06-01 10:14:49.377586
pkg:deb/ubuntu/ruby-nokogiri purl2cpe 2026-06-01 10:14:49.377587
pkg:gem/nokogiri purl2cpe 2026-06-01 10:14:49.377589
pkg:github/sparklemotion/nokogiri purl2cpe 2026-06-01 10:14:49.377590
pkg:rpm/fedora/rubygem-nokogiri purl2cpe 2026-06-01 10:14:49.377592
pkg:rpm/opensuse/rubygem-nokogiri purl2cpe 2026-06-01 10:14:49.377593

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-26247 vulnerable 2026-06-08 05:23:50.962963 XXE in Nokogiri
LOW (2.6)
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
Published: 2020-12-30T00:00:00.000Z
Updated: 2024-08-04T15:56:04.939Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.