How severe is CVE-2026-126063?

No CVSS score has been assigned to CVE-2026-126063 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-126063?

CVE-2026-126063 affects the following packages: nokogiri (RubyGems). Ecosystems affected: RubyGems.

How do I fix CVE-2026-126063?

Update nokogiri to 1.19.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-126063 is resolved across your whole dependency graph.

How do I detect CVE-2026-126063 in my RubyGems dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-126063 if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is CVE-2026-126063 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-126063 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What type of vulnerability is CVE-2026-126063?

CVE-2026-126063 is classified as Cross-site Scripting (XSS) (CWE-79), CWE-116 (CWE-116). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2026-126063 published, and has it been updated?

CVE-2026-126063 was published on November 10, 2026 and was last updated on November 10, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

💎 RubyGems

Not in CISA KEV

CVE-2026-126063 — nokogiri

Fix: sparklemotion/nokogiri#3752

CVE-2026-126063 is a Cross-site Scripting (XSS) vulnerability in nokogiri. A fix is available for nokogiri — see the affected versions and patch details below.

Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Published

Nov 10, 2026

Updated

Nov 10, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

💎nokogiri

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Nokogiri's HTML5 serializer did not escape text inside noscript elements, or < and > inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.

Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parse_noscript_content_as_text: true.

Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5.

Severity

The Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). Exploitation requires an application that allows noscript in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.

Mitigation

Upgrade to Nokogiri 1.19.5 or later.

Applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true (available since Nokogiri 1.17.0), or remove noscript elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside noscript is serialized unchanged, as the standard requires.

Credit

This issue was responsibly reported by @a-zara-n.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
💎RubyGems	`nokogiri`	≥ 1.12.0&&< 1.19.5	1.19.5`bundle update nokogiri --conservative`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update nokogiri to 1.19.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-126063 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Summary Nokogiri's HTML5 serializer did not escape text inside `noscript` elements, or `<` and `>` inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with `Nokogiri::HTML5`, allow `noscript` elements, and send the serialized output to browsers. Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside `noscript` is still emitted unescaped f

O3 Security · Impact-Aware SCA

Is CVE-2026-126063 in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works