How severe is CVE-2026-57234?

CVE-2026-57234 has a CVSS 3.x base score of 2.6, rated low severity. It is exploitable over network with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-57234 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-57234?

CVE-2026-57234 affects Nokogiri. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-57234?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-57234 have an EU (EUVD) identifier?

Yes. CVE-2026-57234 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-39421.

When was CVE-2026-57234 published?

CVE-2026-57234 was published on 2026-06-25 and last updated on 2026-06-26.

CVE-2026-57234

CVE-2026-57234 is a low-severity vulnerability in Nokogiri with a CVSS 3.x base score of 2.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-178.

Key facts

Severity: Low (CVSS 3.x base score 2.6)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-39421
Weakness: CWE-178
Affected product: Nokogiri
Published: 2026-06-25
Last modified: 2026-06-26

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

Frequently asked questions

What is CVE-2026-57234?: Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
How severe is CVE-2026-57234?: CVE-2026-57234 has a CVSS 3.x base score of 2.6, rated low severity. It is exploitable over network with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-57234 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-57234?: CVE-2026-57234 affects Nokogiri. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-57234?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-57234 have an EU (EUVD) identifier?: Yes. CVE-2026-57234 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-39421.
When was CVE-2026-57234 published?: CVE-2026-57234 was published on 2026-06-25 and last updated on 2026-06-26.

References

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2

Affected products (1)

cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*

More vulnerabilities in Nokogiri

CVE-2019-5477 — Critical (CVSS 9.8): A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via…
CVE-2026-57236 — High (CVSS 8.2): Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling…
CVE-2026-57235 — High (CVSS 8.2): Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,…
CVE-2022-29181 — High (CVSS 8.2): Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all…
CVE-2026-57435 — High (CVSS 7.5): Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby…
CVE-2026-57434 — High (CVSS 7.5): Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a…

All CVEs affecting Nokogiri →

Other CWE-178 vulnerabilities

CVE-2026-54763 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth,…
CVE-2026-40453 — Critical (CVSS 9.9): The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such…
CVE-2026-47323 — Critical (CVSS 9.8): Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative…
CVE-2024-5699 — Critical (CVSS 9.8): In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by…
CVE-2023-3545 — Critical (CVSS 9.8): Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache…
CVE-2022-29604 — Critical (CVSS 9.8): An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which…

Browse all CWE-178 vulnerabilities →