https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:34:52.713052+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-57234 BELL-CVE-2026-57234 2026-10-04T04:34:52.823273+00:00

Affected: Alpaquita:stream: ruby-nokogiri

 https://cve.radiocsirt.org/vuln/brew-mikutter-cve-2026-57234 BREW-mikutter-CVE-2026-57234 — Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 2026-10-04T04:34:52.823325+00:00

Affected: Homebrew: mikutter

### Summary

The `NONET` parse option, which Nokogiri turns on by default for `Nokogiri::XML::Schema` (see [CVE-2020-26247](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m)), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks.

Nokogiri 1.19.4 replaces the scheme denylist with an allowlist. When `NONET` is enabled, only local resources (a `file:` scheme, or a relative or absolute path with no scheme) are resolved, and every network scheme is blocked, case-insensitively. This brings the JRuby behavior in line with CRuby.

Only the JRuby implementation is affected. CRuby is not affected, because libxml2's `xmlNoNetExternalEntityLoader` blocks all network schemes at the I/O layer regardless of scheme or case.

### Severity

The Nokogiri maintainers have evaluated this as low severity (CVSS 2.6, `CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N`). It is a bypass of CVE-2020-26247, which was scored the same way.

### Mitigation

Upgrade to Nokogiri 1.19.4 or later.

There are no known workarounds for affected versions.

This change properly enforces `NONET` on JRuby, which is a breaking change for any code that (perhaps unknowingly) relied on the previous behavior to load network resources with default parse options. If you trust your input and want to allow external resources to be acces…

 https://cve.radiocsirt.org/vuln/euvd-2026-330290 EUVD-2026-330290 2026-10-04T04:34:52.823379+00:00 EUVD-2026-330290 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57234 fkie_cve-2026-57234 2026-10-04T04:34:52.823395+00:00

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

 https://cve.radiocsirt.org/vuln/ghsa-8678-w3jw-xfc2 GHSA-8678-w3jw-xfc2 — Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 2026-10-04T04:34:52.823419+00:00

Affected: RubyGems: nokogiri

### Summary

The `NONET` parse option, which Nokogiri turns on by default for `Nokogiri::XML::Schema` (see [CVE-2020-26247](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m)), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks.

Nokogiri 1.19.4 replaces the scheme denylist with an allowlist. When `NONET` is enabled, only local resources (a `file:` scheme, or a relative or absolute path with no scheme) are resolved, and every network scheme is blocked, case-insensitively. This brings the JRuby behavior in line with CRuby.

Only the JRuby implementation is affected. CRuby is not affected, because libxml2's `xmlNoNetExternalEntityLoader` blocks all network schemes at the I/O layer regardless of scheme or case.

### Severity

The Nokogiri maintainers have evaluated this as low severity (CVSS 2.6, `CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N`). It is a bypass of CVE-2020-26247, which was scored the same way.

### Mitigation

Upgrade to Nokogiri 1.19.4 or later.

There are no known workarounds for affected versions.

This change properly enforces `NONET` on JRuby, which is a breaking change for any code that (perhaps unknowingly) relied on the previous behavior to load network resources with default parse options. If you trust your input and want to allow external resources to be acces…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-57234 msrc_CVE-2026-57234 — Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 2026-10-04T04:34:52.823467+00:00 msrc_CVE-2026-57234 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-57234 UBUNTU-CVE-2026-57234 2026-10-04T04:34:52.823486+00:00

Affected: Ubuntu:Pro:14.04:LTS: ruby-nokogiri, Ubuntu:16.04:LTS: ruby-nokogiri, Ubuntu:18.04:LTS: ruby-nokogiri, Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri, Ubuntu:24.04:LTS: ruby-nokogiri, Ubuntu:25.10: ruby-nokogiri, Ubuntu:26.04:LTS: ruby-nokogiri

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.