Vulnerability GHSA-3w22-6jfg-527w

Low Risk

11 hours ago

Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value

1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.4

Summary

Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value

Details

Summary

Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.

This is the same class of issue as GHSA-phwj-rprq-35pp, which was fixed for Attr#value= in Nokogiri 1.19.4.

Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.

JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via Node#[]= or Node#lang=. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.