Dashboard / CVE-2026-57437

CVE-2026-57437

LOW
INFO Priority: 0.01 BB Relevance: 63/100
Published: 2026-06-25 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: Present
VC: None
VI: None
VA: Low

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
nokogiri nokogiri < 1.19.4

References & Advisories (1)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

1.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

EPSS — Exploitation Probability

0.40%
Raw Score 0.004020
Percentile 34.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00402
2026-10-28
0.00402

Intelligence Sources

nvd ref →

External Links