CVE-2026-57234CWE-178CWE-184CWE-611

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

Low · published June 25, 2026

CVSS v3.1
2.6
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Weaknesses
CWE-178 · Improper Handling of Case Sensitivity; CWE-184 · Incomplete List of Disallowed Inputs; CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-06-25T14:30Z
EPSS history
Timeline
  • 25 JUN 14:30Z
    Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
    cvelistv5