GHSA-wjv4-x9w8-wm3hLow▾ SunlitNokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault.
Nokogiri 1.19.4 restricts Document#root= to element nodes, raising TypeError for any other node type.
This memory-safety issue affects only the CRuby implementation (libxml2). The JRuby implementation was not affected; the same input validation was added there for behavioral parity.
The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to assign a non-element node such as a DTD as the document root via Document#root=. Nokogiri 1.19.4 now raises TypeError instead of allowing a use-after-free. It cannot be triggered by untrusted input or through normal use of the public API.
Upgrade to Nokogiri 1.19.4 or later.
As a workaround, applications that cannot upgrade should avoid assigning a DTD (or any non-element node) via Document#root=.
This issue was responsibly reported by Zheng Yu from depthfirst.com.
nokogiri < 1.19.4Upgrade to a patched release:
nokogiri 1.19.4Connected by shared product, vendor, weakness, or advisory.
GHSA-5v8h-3h3q-446pLowNokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
GHSA-p67v-3w7g-wjg7LowNokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
GHSA-wfpw-mmfh-qq69LowNokogiri: Possible Use-After-Free in XInclude Processing
GHSA-phwj-rprq-35ppLowNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
GHSA-8678-w3jw-xfc2Low· 2.6Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
GHSA-9cv2-cfxc-v4v2LowNokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes