Nokogiri has vulnerable dependencies on libxml2 and libxslt

HIGH 8.8CVE-2021-30560 · GHSA-59gp-qqm7-cw4j · Published 03/08/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
nokogiri RubyGems	`< 1.13.2`	`1.13.2`
chrome google	`< 91.0.4472.164`	`91.0.4472.164`
universal forwarder splunk	`= 9.1.0≥ 8.2.0, < 8.2.12≥ 9.0.0, < 9.0.6`	`8.2.129.0.6`
libxslt xmlsoft	`< 1.1.35`	`1.1.35`

Description

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

NVD description

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References

sparklemotion/nokogiri security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-30560 · ADVISORY
chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html · WEB
crbug.com/1219209 · WEB
rubysec/ruby-advisory-db · WEB
sparklemotion/nokogiri · PACKAGE
sparklemotion/nokogiri release v1.13.2 · WEB
lists.debian.org/debian-lts-announce/2022/09/msg00010.html · WEB
security.gentoo.org/glsa/202310-23 · WEB
debian.org/security/2022/dsa-5216 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free