CVE-2026-79772: falha de média gravidade em sparklemotion nokogiri
Nokogiri before 1.19.1 Unchecked Return Value canonicalize
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
sparklemotion · nokogiriCVEs relacionadas — sparklemotion nokogiri
No mesmo produto, das mais perigosas para as menos.
CVE-2022-24836HIGHInefficient Regular Expression Complexity in NokogiriEPSS 3.5%CVE-2022-29181HIGHImproper Handling of Unexpected Data Type in NokogiriEPSS 3.2%CVE-2022-23476HIGHUnchecked return value from xmlTextReaderExpand in NokogiriEPSS 1.8%CVE-2021-41098HIGHImproper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyEPSS 1.5%CVE-2020-26247LOWXXE in NokogiriEPSS 1.2%CVE-2026-79770HIGHNokogiri before 1.19.3 ReDoS via CSS selector tokenizerEPSS 0.5%