Nokogiri versions before 1.13.2 (CRuby, using packaged libraries) bundle outdated libxml2 and libxslt builds carrying two upstream vulnerabilities, rated CVSS 9.8 CRITICAL by the assigning CNA.
What Is It
CVE-2022-51000 tracks Nokogiri's exposure to two upstream flaws inherited through its vendored dependencies. Nokogiri before 1.13.2 ships libxml2 2.9.12 and libxslt 1.1.34, both of which are affected:
- CVE-2021-30560 (libxslt): an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack.
- CVE-2022-23308 (libxml2): an application parsing an untrusted document with the parse option
DTDVALIDset to true andNOENTset to false may be vulnerable to denial of service, memory disclosure, or code execution.
The weakness is classified as CWE-416 (Use After Free).
Why It Matters
The CNA-supplied CVSS 3.1 base score is 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, and no user interaction required, with high confidentiality, integrity, and availability impact. A CVSS 4.0 score of 9.3 (CRITICAL) is also recorded. Both figures come from the CVE record itself; NVD has not yet published its own analysis or an authoritative NVD-assigned score for this CVE, so the severity should be treated as provisional and subject to change on enrichment.
The practical concern is reach: Nokogiri is one of the most widely deployed XML/HTML parsing gems in the Ruby ecosystem, and the vulnerable code is vendored rather than pulled from the system, so patching the host's libxml2 does not remediate it.
CVE-2022-51000 does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed.
What's Vulnerable
- Vendor/Product: sparklemotion / nokogiri (
pkg:gem/nokogiri) - Affected: all versions below 1.13.2 (CRuby, when using packaged libraries)
- Unaffected: 1.13.2 and later
Patch Status
Patched. Nokogiri 1.13.2 upgrades the vendored libxml2 to 2.9.13 and libxslt to 1.1.35. Upgrade the gem to 1.13.2 or later. No KEV-mandated remediation deadline applies, as the CVE is absent from the CISA Known Exploited Vulnerabilities catalog. The CVE record was published 2026-08-25 and its NVD status is currently "Received."