AZL-113627: CVE-2026-126063 affecting package rubygem-nokogiri 1.19.4-1
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parsenoscriptcontentastext: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygem-nokogirito a version that resolves this vulnerability.Fixed in 1.19.5 - Configuration
Set parse_noscript_content_as_text to true as a workaround.
Nokogiri parse_noscript_content_as_text = true
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Nokogiri 1.12.0 through 1.19.4 on CRuby or TruffleRuby may be exposed if they sanitize untrusted HTML using the default parsing options, allow noscript elements, and return the serialized HTML to browsers with scripting enabled. JRuby is not affected.
What must an attacker be able to do to exploit it?
An attacker needs to supply untrusted HTML that is processed by the affected HTML5 sanitizer and later delivered to a scripting-enabled browser. Exploitation depends on the application allowing noscript elements during sanitization.
Is the default configuration affected?
Yes. The vulnerable behavior occurs when untrusted HTML is sanitized with the default parsing options and noscript is allowed. The recommended non-default workaround is to set parse_noscript_content_as_text: true.
What can be done if upgrading is not immediately possible?
Configure parsing with parse_noscript_content_as_text: true. This is the recommended workaround for the vulnerable default behavior.
How can I determine whether my application is affected?
Check whether it uses the Nokogiri C extension on CRuby or TruffleRuby, has a Nokogiri version from 1.12.0 through 1.19.4, sanitizes attacker-controlled HTML with default parsing options, permits noscript, and serves the resulting serialized HTML to scripting-enabled browsers.