Executive Summary

This vulnerability is a use-after-free issue in Nokogiri's Nokogiri::XML::XPathContext. It occurs when an XPathContext object outlives its source XML document, and the document is garbage collected while the XPathContext is still in use. Evaluating an XPath expression in this state can cause the program to read invalid memory and potentially crash with a segmentation fault.

This problem only arises if application code directly constructs an XPathContext and allows the source document to become unreachable while continuing to use the XPathContext. Normal Nokogiri document search methods like Document#xpath or #css are not affected.

The vulnerability is fixed in Nokogiri version 1.19.4 by ensuring the XPathContext keeps its source document alive as long as the context exists.

Useful 0 Not Useful 0

Impact Analysis

If your application uses Nokogiri and directly constructs XPathContext objects without keeping the source document referenced, this vulnerability could cause your application to crash unexpectedly due to segmentation faults.

However, the impact is limited because this requires an unusual usage pattern not common in normal operations, and normal Nokogiri search methods are not affected.

To avoid this impact, you should upgrade to Nokogiri version 1.19.4 or later, or ensure that the source document remains referenced while any XPathContext derived from it is in use.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs only when application code directly constructs a Nokogiri::XML::XPathContext and allows its source document to be garbage collected while the context is still in use. It is not triggered by normal document search methods or malicious input.

Detection would involve reviewing your Ruby application code to identify any direct usage of Nokogiri::XML::XPathContext where the source document might become unreachable before the context is discarded.

There are no specific network or system commands provided to detect this vulnerability automatically.

A practical approach is to check the Nokogiri version installed on your system using the following Ruby command:

• ruby -rnokogiri -e 'puts Nokogiri::VERSION'

If the version is earlier than 1.19.4, your application may be vulnerable if it uses the affected API pattern.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Nokogiri to version 1.19.4 or later, where the vulnerability is fixed by ensuring the XPathContext keeps its source document alive.

Alternatively, if upgrading is not immediately possible, ensure that your application code maintains a reference to the source document for as long as any XPathContext derived from it is in use, preventing the document from being garbage collected prematurely.

Since this vulnerability requires an unusual API usage pattern, reviewing and modifying the code to avoid constructing XPathContext directly or to manage document lifetimes properly can also mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0