CVE-2022-29181

Deeper analysis

Nokogiri is an open source XML and HTML library for Ruby. Versions prior to 1.13.6 fail to perform type checks on all inputs supplied to the XML and HTML4 SAX parsers, allowing specially crafted untrusted data to trigger illegal memory accesses that produce segmentation faults or reads from unrelated memory regions. The issue is tracked under CWE-241 and CWE-843 and carries a CVSS 3.1 score of 8.2.

An unauthenticated remote attacker can supply malicious input directly to an affected parser and thereby induce a denial-of-service condition or limited information disclosure. No user interaction or elevated privileges are required.

The project’s security advisory and release notes for version 1.13.6 state that the vulnerability is resolved by the commits included in that release. As a temporary mitigation, callers can coerce untrusted input to a Ruby String via #to_s before passing it to the parsers.

EPSS scores for the CVE reached a peak of 0.0576 before receding to the current value of 0.0418; no public reports of in-the-wild exploitation have been noted in the referenced materials.