| Package | Affected versions | Patched versions |
|---|---|---|
| nokogiri | < 1.10.5 | 1.10.5 |
| libxslt | < 1.1.33 | 1.1.33 |
Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.
Nokogiri prior to version 1.10.5 contains a vulnerable version of libxslt. Nokogiri version 1.10.5 upgrades the dependency to libxslt 1.1.34, which contains a patch for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free