VulnerableCode Package Details - pkg:gem/nokogiri@1.18.10

Search for packages

Vulnerability	Summary	Fixed by
VCID-jfh3-1sgm-7ug2 Aliases: GHSA-wx95-c6cv-8532	Nokogiri does not check the return value from xmlC14NExecute ## Summary Nokogiri's CRuby extension fails to check the return value from `xmlC14NExecute` in the method `Nokogiri::XML::Document#canonicalize` and `Nokogiri::XML::Node#canonicalize`. When canonicalization fails, an empty string is returned instead of raising an exception. This incorrect return value may allow downstream libraries to accept invalid or incomplete canonicalized XML, which has been demonstrated to enable signature validation bypass in SAML libraries. JRuby is not affected, as the Java implementation correctly raises `RuntimeError` on canonicalization failure. ## Mitigation Upgrade to Nokogiri `>= 1.19.1`. ## Severity The maintainers have assessed this as Medium severity. Nokogiri itself is a parsing library without a clear security boundary related to canonicalization, so the direct impact is that a method returns incorrect data on invalid input. However, this behavior was exploited in practice to bypass SAML signature validation in downstream libraries (see References). ## Credit This vulnerability was responsibly reported by HackerOne researcher `d4d`.	1.19.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-jfh3-1sgm-7ug2
Aliases:
GHSA-wx95-c6cv-8532

Nokogiri does not check the return value from xmlC14NExecute ## Summary Nokogiri's CRuby extension fails to check the return value from `xmlC14NExecute` in the method `Nokogiri::XML::Document#canonicalize` and `Nokogiri::XML::Node#canonicalize`. When canonicalization fails, an empty string is returned instead of raising an exception. This incorrect return value may allow downstream libraries to accept invalid or incomplete canonicalized XML, which has been demonstrated to enable signature validation bypass in SAML libraries. JRuby is not affected, as the Java implementation correctly raises `RuntimeError` on canonicalization failure. ## Mitigation Upgrade to Nokogiri `>= 1.19.1`. ## Severity The maintainers have assessed this as **Medium** severity. Nokogiri itself is a parsing library without a clear security boundary related to canonicalization, so the direct impact is that a method returns incorrect data on invalid input. However, this behavior was exploited in practice to bypass SAML signature validation in downstream libraries (see References). ## Credit This vulnerability was responsibly reported by HackerOne researcher `d4d`.

1.19.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-17T00:18:19.850942+00:00	GitLab Importer	Affected by	VCID-jfh3-1sgm-7ug2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/nokogiri/GHSA-wx95-c6cv-8532.yml	38.4.0
2026-04-12T01:42:38.302985+00:00	GitLab Importer	Affected by	VCID-jfh3-1sgm-7ug2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/nokogiri/GHSA-wx95-c6cv-8532.yml	38.3.0
2026-04-03T01:51:28.126949+00:00	GitLab Importer	Affected by	VCID-jfh3-1sgm-7ug2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/nokogiri/GHSA-wx95-c6cv-8532.yml	38.1.0