CVE-2026-57234: Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
Other sources
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.19.4-1 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.4
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-57234?
The risk level of CVE-2026-57234 is 15, classified as low severity (2.6).
How does CVE-2026-57234 affect Nokogiri?
CVE-2026-57234 allows network requests when the NONET option is set in Nokogiri on JRuby, thereby bypassing previous security measures.
What software is impacted by CVE-2026-57234?
CVE-2026-57234 affects Nokogiri XML::Schema prior to version 1.19.4.
Is there a way to mitigate CVE-2026-57234?
To mitigate CVE-2026-57234, you should upgrade Nokogiri to version 1.19.4 or later.
What vulnerabilities are associated with CVE-2026-57234?
CVE-2026-57234 is associated with XML External Entity (XXE) and Server Side Request Forgery (SSRF) vulnerabilities.