CVE-2026-126063

Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Products / packages sparklemotion nokogiri · nokogiri

Published 10/11/2026, 20:14:40 UTC

Severity and exploitation

Not in CISA KEVSource: LOW

KEV coverage does not rule out exploitation.

KEV checked 15/11/2026, 03:00:33 UTC

OSV · CVSS:4.0 · 2.3

Assessment vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

GitHub_M · CVSS:4.0 · 2.3

Assessment vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

The headline uses the highest imported catalog score. Assessments can differ by source and CVSS version.

Severity

low2.3

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Package fixes recorded

Fix versions are recorded for 1 of 1 mapped packages. Check each release branch and any separate product guidance.

What this means

Nokogiri's HTML5 serializer did not escape text inside noscript elements, or inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.

Source excerpt · OSV

Attack conditions

Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Exploitation requires an application that allows noscript in sanitized HTML. This is the workaround for earlier versions, and it is recommended on every version: some content inside noscript is serialized unchanged, as the standard requires.

Excerpt from the original source description below.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

sparklemotion · GitHub_M

nokogiri

1 range

GitHub_M version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

>= 1.12.0, < 1.19.5

Other versions: unknown

Packages

Compare each installed version with the publisher’s affected ranges. Where a fix is recorded, choose the appropriate release branch and test compatibility before upgrading.

nokogiri RubyGems

Affected range	Recorded fix
From 1.12.0 before 1.19.5Ecosystem versions	1.19.5

Version evidence: OSV · GHSA-4p39-36wj-23h4

View original version evidence (62 explicit versions)

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

Use the recorded fix for your release branch. Review the publisher’s instructions and test compatibility before upgrading.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

Summary

Nokogiri's HTML5 serializer did not escape text inside noscript elements, or < and > inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.

Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parse_noscript_content_as_text: true.

Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5.

Severity

The Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). Exploitation requires an application that allows noscript in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.

Mitigation

Upgrade to Nokogiri 1.19.5 or later.

Applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true (available since Nokogiri 1.17.0), or remove noscript elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside noscript is serialized unchanged, as the standard requires.

Credit

This issue was responsibly reported by @a-zara-n.

References

7 sources

sparklemotion/nokogiri · security/advisories/GHSA-4p39-36wj-23h4

Security advisoryGitHub_M

sparklemotion/nokogiri · pull request #3752

PatchGitHub_M

sparklemotion/nokogiri · commit 3e84df6

PatchGitHub_M

sparklemotion/nokogiri · commit c6c0bff

PatchGitHub_M

rubysec/ruby-advisory-db · GHSA-4p39-36wj-23h4.yml

Source reference

sparklemotion/nokogiri · repository

Source reference

View 1 more references

sparklemotion/nokogiri · releases/tag/v1.19.5

Release notesGitHub_M

Inside the record

Evidence available

Package identity

Version evidence

Remediation guidance · not supplied

Weakness classification

Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-126063

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-79 ↗

CWE-79: Improper Neutralization of Input During Web Page Generation

GitHub_M

CWE-116 ↗

CWE-116: Improper Encoding or Escaping of Output

GitHub_M

Contributing organizations · 2

GitHub_M

Assigning organization

2026-11-10

CISA-ADP

Additional data publisher

2026-11-13

Timeline

All times UTC

10 Nov 2026, 20:14
Advisory published
Publication date supplied by the source.
13 Nov 2026, 15:51
Source updated
Latest modification date supplied by the source.
13 Nov 2026, 23:26
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes

CVE · CVE-2026-1260632026-11-13

Observed 2026-11-13T23:26:44.452Z · upstream updated 2026-11-13T15:51:43.029Z

Prioritization updated

before

[]

after

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-11-13T15:49:25.822174Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

Reading the signals

Severity · CVSS: Technical impact and attack conditions. The headline is the highest imported catalog score; sources may disagree.
Observed exploitation · KEV: An absent or unavailable KEV listing does not establish that exploitation has not occurred.
Predicted exploitation · EPSS: 0.56% estimated probability in the next 30 days. 2026-11-13 · FIRST EPSS.

CISA-ADP · SSVC

CISA Coordinator · 2026-11-13

Exploitation: none
Automatable: no
Technical Impact: partial

SSVC describes the publisher’s decision context. Your organization’s exposure and priorities may differ.

Record identifiers

Aliases: GHSA-4p39-36wj-23h4

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

OSV GHSA-4p39-36wj-23h4 CVE CVE-2026-126063

Enrichment coverage

NVDAvailable

Checked 14/11/2026, 05:26:06 UTC

GHSAAvailable

Checked 14/11/2026, 05:20:32 UTC

EUVDAvailable

Checked 14/11/2026, 05:15:32 UTC

EPSSAvailable

Checked 14/11/2026, 05:15:31 UTC

Additional source evidence

FIRST EPSS · CVE-2026-126063

EPSS 0.56% probability of exploitation in the next 30 days. Percentile: 47.24% · 2026-11-13

Checked 14/11/2026, 05:15:31 UTC

ENISA EUVD · EUVD-2026-122832

CVSS 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Checked 14/11/2026, 05:15:32 UTC

GitHub Advisory Database · GHSA-4p39-36wj-23h4Checked 14/11/2026, 05:20:32 UTC

NVD · CVE-2026-126063

CVSS 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Checked 14/11/2026, 05:26:06 UTC

Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.View as JSON

Investigate in your agent.

Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Severity and exploitation

What this means

Attack conditions

Affected versions

nokogiri

affected

unaffected

unknown

Packages

What to do

Public exploit evidence

Original source description

Summary

Severity

Mitigation

Credit

References

Inside the record

Evidence available

Original records

Underlying weaknesses

Timeline

Advisory published

Source updated

Last imported by cve.new

What changed