Nokogiri 1.11.0 Release Candidate 3 for Ruby

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:nokogiri:nokogiri:1.11.0:rc3:*:*:*:ruby:*:*

part: a version: 1.11.0 update: rc3

VendorNokogiri (978e9520-dade-5e37-bec5-059e1fdaac31)
ProductNokogiri (e2c62fac-c61c-5701-871d-48aa8ee9ff17)
Edition*
Language*
Software edition*
Target softwareruby
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/ruby-nokogiri purl2cpe 2026-06-01 10:14:49.377594
pkg:deb/ubuntu/ruby-nokogiri purl2cpe 2026-06-01 10:14:49.377596
pkg:gem/nokogiri purl2cpe 2026-06-01 10:14:49.377597
pkg:github/sparklemotion/nokogiri purl2cpe 2026-06-01 10:14:49.377598
pkg:rpm/fedora/rubygem-nokogiri purl2cpe 2026-06-01 10:14:49.377600
pkg:rpm/opensuse/rubygem-nokogiri purl2cpe 2026-06-01 10:14:49.377601

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-26247 vulnerable 2026-06-08 05:23:50.972540 XXE in Nokogiri
LOW (2.6)
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
Published: 2020-12-30T00:00:00.000Z
Updated: 2024-08-04T15:56:04.939Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.