UBUNTU-CVE-2026-126063: Medium severity ubuntu/ruby-nokogiri vulnerability
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parsenoscriptcontentastext: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.5 - Configuration
Set parse_noscript_content_as_text to true when parsing HTML as a workaround.
Nokogiri::HTML5 serializer parse_noscript_content_as_text = true
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Nokogiri’s C extension on CRuby or TruffleRuby are affected from version 1.12.0 through 1.19.4. JRuby is not affected because it does not implement Nokogiri::HTML5.
What conditions are needed for exploitation?
An application must sanitize untrusted HTML using the default parsing options, permit noscript elements, and send the serialized result to a browser with scripting enabled. Under those conditions, an attacker may cause the browser to parse markup that Nokogiri did not produce.
Is the default configuration vulnerable?
Yes. The vulnerable behavior occurs when untrusted HTML is sanitized with Nokogiri’s default parsing options and noscript is allowed.
What can be done if upgrading is not immediately possible?
Use parse_noscript_content_as_text: true when parsing. This is the recommended workaround and is not the vulnerable default.
What version fixes the issue?
The issue is fixed in Nokogiri version 1.19.5.