Arbitrary Code Execution Affecting nokogiri package, versions >=1.6.0, <1.6.8
Threat Intelligence
EPSS
2.17% (90th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-NOKOGIRI-20277
- published 6 Jun 2016
- disclosed 13 Apr 2016
- credit Unknown
Introduced: 13 Apr 2016
CVE-2015-8806 Open this link in a new tabHow to fix?
Upgrade nokogiri to version 1.6.8 or higher.
Overview
nokogiri is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.
Affected versions of this gem are vulnerable to Arbitrary Code Execution attacks. Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries Nokogiri depends on. libxml2 and libxslt incorrectly handled certain malformed documents, which can allow attackers to perform a Denial of Service or Arbitrary Code Execution attacks.
References
CVSS Scores
version 3.1