Vulnerabilities in Nokogiri Vendored libxml2 and libxslt Libraries

Nokogiri versions prior to 1.13.2 (CRuby with packaged libraries) bundle vulnerable versions of libxml2 (2.9.12) and libxslt (1.1.34). These bundled libraries introduce critical security risks to Ruby applications relying on Nokogiri for XML/XSL processing. CVE-2021-30560 in libxslt enables denial-of-service attacks when processing untrusted XSL stylesheets. More severely, CVE-2022-23308 in libxml2 allows for denial-of-service, memory disclosure, or arbitrary code execution if an application parses untrusted XML documents with the DTDVALID option set to true and NOENT set to false. Because these libraries are vendored directly within the Nokogiri gem, simply updating system-level libraries is insufficient; the gem itself must be updated to version 1.13.2 or later to include the patched libxml2 (2.9.13) and libxslt (1.1.35) binaries.

Impact

Applications using affected versions of Nokogiri are vulnerable to exploitation when processing untrusted input. Successful exploitation can lead to complete service instability (DoS), leakage of sensitive process memory, or full remote code execution, depending on the specific application implementation and the XML parsing flags enabled. This affects any environment utilizing the Ruby gem on any operating system where the packaged libraries are utilized.

Recommendation

• Identify all Ruby projects utilizing Nokogiri < 1.13.2 by auditing Gemfile.lock files or scanning vendor directory assets.
• Update Nokogiri to version 1.13.2 or later to ensure the inclusion of patched libxml2 2.9.13 and libxslt 1.1.35.
• Review application logic to ensure XML parsing configurations avoid insecure settings like DTDVALID=true when processing untrusted content.