Vulnerability GHSA-v995-44v6-5fqm
Low Risk
LOW RISK
CVSS Score: 3.7
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
11 hours ago
November 10, 2026 at 08:52 PM UTC
JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.4
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.4
Summary
JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
Details
Summary
On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF.
Nokogiri 1.19.5 applies the XML::Schema check from GHSA-8678-w3jw-xfc2: with NONET set, only local resources are loaded.
Only JRuby is affected. Default parse options are not affected.
Severity
The Nokogiri maintainers have evaluated this as low severity.
Mitigation
Upgrade to Nokogiri 1.19.5 or later, or do not enable DTDLOAD, DTDVALID or NOENT for untrusted input.
Credit
This issue was responsibly reported by @arpitjain099.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
11 hours ago
Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.4 GHSA-3w22-6jfg-527w
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.4 GHSA-3w22-6jfg-527w
Low Risk
12 hours ago
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.4 GHSA-4p39-36wj-23h4
1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.4 GHSA-4p39-36wj-23h4
Low Risk
4 months ago
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.3 GHSA-phwj-rprq-35pp
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.3 GHSA-phwj-rprq-35pp
Low Risk
4 months ago
Nokogiri: Possible Use-After-Free in XInclude Processing
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.3 GHSA-wfpw-mmfh-qq69
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.3 GHSA-wfpw-mmfh-qq69
Low Risk
4 months ago
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.3 GHSA-p67v-3w7g-wjg7
1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.3 GHSA-p67v-3w7g-wjg7
Impacted packages
Timeline
Published
11 hours ago
November 10, 2026 at 08:52 PM UTC
Fixed (1.19.5)
9 days ago
November 02, 2026 at 03:40 AM UTC
Last Modified
11 hours ago
November 10, 2026 at 09:00 PM UTC