CVE-2026-126063: Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
Summary
Nokogiri's HTML5 serializer did not escape text inside noscript elements, or < and > inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.
Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parsenoscriptcontentastext: true.
Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5.
Severity
The Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). Exploitation requires an application that allows noscript in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.
Mitigation
Upgrade to Nokogiri 1.19.5 or later.
Applications that sanitize HTML and allow noscript should parse with parsenoscriptcontentastext: true (available since Nokogiri 1.17.0), or remove noscript elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside noscript is serialized unchanged, as the standard requires.
Credit
This issue was responsibly reported by @a-zara-n.
Other sources
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parsenoscriptcontentastext: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/nokogirito a version that resolves this vulnerability.Fixed in 1.19.5 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.5 - Configuration
Parse with parse_noscript_content_as_text: true when sanitizing HTML that allows noscript elements.
Nokogiri::HTML5 parse_noscript_content_as_text = true
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use Nokogiri versions from 1.12.0 through 1.19.5 on CRuby or TruffleRuby and invoke the Nokogiri::HTML5 serializer. JRuby is not affected because it does not implement Nokogiri::HTML5.
What conditions are required for exploitation?
An application must sanitize untrusted HTML using the default parsing options, permit noscript elements, and send the serialized result to a browser with scripting enabled. Under those conditions, the browser may parse markup that Nokogiri did not produce.
Is the default configuration vulnerable?
Yes. The vulnerable behavior occurs with the default parsing options when noscript is allowed. The recommended workaround is to set parse_noscript_content_as_text: true.
What should teams do if they cannot immediately update?
Use parse_noscript_content_as_text: true when parsing untrusted HTML. This is the recommended workaround; the issue is fixed in Nokogiri version 1.19.5.