DEBIAN-CVE-2026-126063: Low severity debian/ruby-nokogiri vulnerability

Published Nov 10, 2026

Updated

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parsenoscriptcontentastext: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.

Affected Software

3 affected components

debian/ruby-nokogiri*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nokogiri to a version that resolves this vulnerability.
Fixed in 1.19.5
Configuration
Set parse_noscript_content_as_text to true when parsing HTML as a workaround.
Nokogiri::HTML5 parse_noscript_content_as_text = true

Event History

Nov 10, 2026

CVE Published

via OSV·09:19 PM

Data Sourced

via OSV·09:19 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Applications using Nokogiri::HTML5 on CRuby or TruffleRuby are exposed if they sanitize untrusted HTML using default parsing options, permit noscript elements, and render the serialized result in a browser with scripting enabled. JRuby is not affected because it does not implement Nokogiri::HTML5.

What must an attacker be able to do to exploit it?

An attacker needs to supply HTML that is processed by the affected sanitizer configuration and later delivered to a scripting-enabled browser. Exploitation relies on the browser interpreting markup within noscript content or attribute values that the serializer did not escape.

Does the default configuration avoid the vulnerability?

No. The issue occurs when untrusted HTML is sanitized with the default parsing options and noscript is allowed; the vulnerable behavior is not avoided by the default parsing mode.

What can be done if upgrading is not immediately possible?

Configure parsing with parse_noscript_content_as_text: true. This is the recommended workaround; upgrading to Nokogiri 1.19.5 also fixes the issue.