DEBIAN-CVE-2026-126063

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-126063
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126063.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-126063
Upstream
Published
2026-11-10T21:19:23Z
Modified
2026-11-11T11:00:06Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.

References

Affected packages

Debian:12 / ruby-nokogiri

Package

Name
ruby-nokogiri
Purl
pkg:deb/debian/ruby-nokogiri?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.13.10+dfsg-2
1.14.2+dfsg-1
1.14.3+dfsg-1
1.14.3+dfsg-2
1.15.4+dfsg-1
1.16.0+dfsg-1
1.16.0+dfsg-2
1.16.2+dfsg-1
1.16.4+dfsg-1
1.17.2+dfsg-1~exp1
1.18.2+dfsg-1
1.18.10+dfsg-1
1.18.10+dfsg-2
1.18.10+dfsg-3
1.19.1+dfsg-1
1.19.3+dfsg-1
1.19.4+dfsg-1
1.19.7+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126063.json"

Debian:13 / ruby-nokogiri

Package

Name
ruby-nokogiri
Purl
pkg:deb/debian/ruby-nokogiri?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.18.2+dfsg-1
1.18.10+dfsg-1
1.18.10+dfsg-2
1.18.10+dfsg-3
1.19.1+dfsg-1
1.19.3+dfsg-1
1.19.4+dfsg-1
1.19.7+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126063.json"

Debian:14 / ruby-nokogiri

Package

Name
ruby-nokogiri
Purl
pkg:deb/debian/ruby-nokogiri?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.18.2+dfsg-1
1.18.10+dfsg-1
1.18.10+dfsg-2
1.18.10+dfsg-3
1.19.1+dfsg-1
1.19.3+dfsg-1
1.19.4+dfsg-1
1.19.7+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126063.json"