Cross-Site Scripting Vulnerability in Nokogiri Library Affecting Ruby Applications
CVE-2026-126063

2.3LOW

Key Information:

Vendor

Sparklemotion

Status
Nokogiri
Vendor
CVE Published:
10 November 2026

What is CVE-2026-126063?

A cross-site scripting vulnerability exists in the Nokogiri library for Ruby, where the Nokogiri::HTML5 serializer fails to properly escape text within noscript elements and angle brackets in attribute values. This flaw permits attackers to inject malicious scripts when untrusted HTML is sanitized and sent to a browser that interprets the output. Implementing the workaround of setting parse_noscript_content_as_text to true is essential to mitigate this issue. The vulnerability affects versions from 1.12.0 until 1.19.5, but doesn't impact JRuby as it does not implement the Nokogiri::HTML5 serializer.

Affected Version(s)

nokogiri >= 1.12.0, < 1.19.5

References

https://github.com/sparklemotion/nokogiri/security/adviso...
x_refsource_CONFIRM
https://github.com/sparklemotion/nokogiri/pull/3752
x_refsource_MISC
https://github.com/sparklemotion/nokogiri/commit/3e84df6f...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.