Skip to content
OpenAdvisories

Vendor

sparklemotion

30 known vulnerabilities.

Products

nokogiri 22 mechanize 5 sqlite3-ruby 2 nekohtml 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-79770

    Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

    Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at…

    sparklemotion nokogiri logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2022-23476

    Unchecked return value from xmlTextReaderExpand in Nokogiri

    Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer e…

    sparklemotion nokogiri nokogiri ruby-nokogiri Debian Alpine RubyGems
  • High 8.2
    CVE-2022-29181

    Improper Handling of Unexpected Data Type in Nokogiri

    Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads…

    sparklemotion nokogiri nokogiri ruby-nokogiri Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2022-24839

    Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)

    org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The…

    sparklemotion nekohtml org.nokogiri:nekohtml nekohtml Debian Ubuntu Maven
  • High 7.5
    CVE-2022-24836

    Inefficient Regular Expression Complexity in Nokogiri

    Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokog…

    sparklemotion nokogiri nokogiri ruby-nokogiri Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2021-41098

    Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

    Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted docume…

    sparklemotion nokogiri nokogiri RubyGems
  • High 7.4
    CVE-2021-21289

    Command Injection Vulnerability in Mechanize

    Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using …

    sparklemotion mechanize ruby-mechanize ruby-mechanize Debian Ubuntu RubyGems