CVE-2022-29181highCWE-241

CVE-2022-29181: high-severity vulnerability in sparklemotion nokogiri

Improper Handling of Unexpected Data Type in Nokogiri

Published · Updated

Follow this CVE+ Monitor nokogiri+ Monitor nokogiri

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 3.2%
In short

Nokogiri, a popular Ruby library for processing XML and HTML, fails to properly validate input types before parsing. This allows attackers to send specially crafted data that can crash the application or leak sensitive information from memory.

Technical detail

CVE-2022-29181 exploits insufficient type-checking in Nokogiri's SAX parsers (XML/HTML4) via untrusted input vectors, resulting in out-of-bounds memory access, segmentation faults, or information disclosure. Pre-condition requires processing user-supplied or network-sourced data through affected parser methods without prior type validation. Impact includes application denial of service and potential memory information leakage.

Summary generated and translated by AI from the official description.
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Affected products
sparklemotion · nokogiri
Related CVEs — sparklemotion nokogiri

In the same product, most dangerous first.

CVE-2022-24836HIGHInefficient Regular Expression Complexity in NokogiriEPSS 3.5%CVE-2022-23476HIGHUnchecked return value from xmlTextReaderExpand in NokogiriEPSS 1.8%CVE-2021-41098HIGHImproper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyEPSS 1.5%CVE-2020-26247LOWXXE in NokogiriEPSS 1.2%CVE-2026-79770HIGHNokogiri before 1.19.3 ReDoS via CSS selector tokenizerEPSS 0.5%CVE-2026-57435LOWNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`EPSS 0.5%