GitHub Advisoryadvisory · RubyGems

GHSA-mrxw-mxhj-p664 Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

HIGH Published 2025-03-14 Modified 2025-03-21 Official page ↗
Ecosystem
RubyGems
Packages
nokogiri
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Weaknesses
CWE-1395, CWE-416
Reviewed
2025-03-14

Affected packages

• RubyGems nokogiri: < 1.18.4 → fixed in 1.18.4

Description

Summary Nokogiri v1.18.4 upgrades its dependency libxslt to v1.1.43. libxslt v1.1.43 resolves: • CVE-2025-24855: Fix use-after-free of XPath context node • CVE-2024-55549: Fix UAF related to excluded namespaces Impact CVE-2025-24855 • "Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node" • MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H • Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128 • NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855 CVE-2024-55549 • "Use-after-free related to excluded result prefixes" • MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H • Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127 • NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55549

Related

Weakness · CWE (2)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-416 Use After Free weakness

References