Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.
Exploitability
AV:NAC:HPR:LUI:RScope
S:UImpact
C:LI:NA:N2.6/CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:NInput Validation