Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via CVE-2022-23308 in libxml2, an application parsing an untrusted document with parse option DTDVALID set to true and NOENT set to false may be vulnerable to denial of service, memory disclosure, or code execution. Nokogiri 1.13.2 upgrades vendored libxml2 to 2.9.13 and libxslt to 1.1.35.

Nokogiri versions before 1.13.2 (CRuby with packaged libraries) ship vendored libxml2 2.9.12 and libxslt 1.1.34, both affected by upstream CVEs. CVE-2021-30560 in libxslt exposes applications to denial-of-service when transforming XML with untrusted XSL stylesheets. CVE-2022-23308 in libxml2 exposes applications to denial-of-service, memory disclosure, or code execution when parsing untrusted documents with specific parse options (DTDVALID=true, NOENT=false). These vulnerabilities are inherited through Nokogiri's vendored/bundled dependencies, representing a supply chain risk. The fix is to upgrade to Nokogiri 1.13.2, which updates libxml2 to 2.9.13 and libxslt to 1.1.35. Applications using older versions of Nokogiri with CRuby and packaged libraries should upgrade immediately. Multiple GitHub commits and security advisories have been issued to address these issues.