Critical USN-4175-1 1 CVE

ruby-nokogiri vulnerability

Published Nov 5, 2019 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Nokogiri incorrectly handled inputs. A remote attacker
could possibly use this issue to execute arbitrary OS commands.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	ruby-nokogiri	1.6.7.2-3ubuntu0.1
Ubuntu · 18.04 LTS 18.04:LTS	ruby-nokogiri	1.8.2-1ubuntu0.1

Vulnerabilities 1

Critical 9.8

CVE-2019-5477

Nokogiri Command Injection Vulnerability

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called wit…

nokogiri ruby-nokogiri ruby-nokogiri ruby-nokogiri Debian Ubuntu Alpine RubyGems

Aug 16, 2019

References

report
https://ubuntu.com/security/CVE-2019-5477