{"id":"CVE-2021-41098","aliases":["GHSA-2rr5-8q37-2w7h"],"url":"https://o3.security/vulnerability/CVE-2021-41098","summary":"Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby","details":"### Severity\n\nThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.0)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/MAV:N/MAC:L) for JRuby users. (This security advisory does not apply to CRuby users.)\n\n\n### Impact\n\nIn Nokogiri v1.12.4 and earlier, **on JRuby only**, the SAX parser resolves external entities by default.\n\nUsers of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:\n\n- Nokogiri::XML::SAX::Parser\n- Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser\n- Nokogiri::XML::SAX::PushParser\n- Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser\n\n\n### Mitigation\n\nJRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.\n\nCRuby users are not affected.","published":"2021-09-27T20:15:07.397Z","modified":"2026-07-09T11:34:10.183115Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"nokogiri","fixedVersion":"1.12.5"}],"fix":{"url":"https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d","label":"sparklemotion/nokogiri@5bf729f"},"references":[{"type":"ADVISORY","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h"},{"type":"FIX","url":"https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41098"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-41098.yml"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T11:34:10.183115Z"}}