{"id":"GHSA-phwj-rprq-35pp","title":"Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`","summary":"Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`","severity":"low","cwe":["CWE-416","CWE-825"],"vendor":"nokogiri","product":"nokogiri","affected":["nokogiri < 1.19.4"],"patched":["nokogiri 1.19.4"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-phwj-rprq-35pp","references":[{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp"},{"url":"https://github.com/advisories/GHSA-phwj-rprq-35pp"}],"tags":["ghsa","rubygems"],"ingestedAt":"2026-06-22T15:52:21.087Z","ecosystem":"rubygems","slug":"GHSA-phwj-rprq-35pp","body":"## Overview\n\n### Summary\n\nNokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, `Nokogiri::XML::Attr#value=` could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault.\n\nNokogiri 1.19.4 preserves any already-wrapped attribute child nodes before replacing the attribute value.\n\nJRuby is not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child node and then replace that same attribute's value via `Attr#value=` or `#content=`. Nokogiri 1.19.4 makes this pattern safe with no change to the public API. Already-wrapped attribute child nodes are preserved before the value is replaced.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.4 or later.\n\nAs a workaround, avoid accessing attribute child nodes directly via `Attr#child` or similar before mutating the same attribute’s value.\n\n### Credit\n\nThis issue was responsibly reported by Zheng Yu from depthfirst.com.\n\n## Affected packages\n\n- `nokogiri < 1.19.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nokogiri 1.19.4`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}