Skip to content

[Aikido] Fix security issue in nokogiri via minor version upgrade from 1.18.10 to 1.19.3 in test#289

Closed
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/AIK-14274-update-packages-41934357-5wlp
Closed

[Aikido] Fix security issue in nokogiri via minor version upgrade from 1.18.10 to 1.19.3 in test#289
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/AIK-14274-update-packages-41934357-5wlp

Conversation

@aikido-autofix

Copy link
Copy Markdown

Upgrade Nokogiri to fix memory leak DoS, canonicalization signature bypass, and ReDoS vulnerabilities in CSS selectors.

✅ 3 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
GHSA-v2fc-qm4h-8hqv
LOW
[nokogiri] XSLT transform leaks small heap allocations when passed Ruby strings containing null bytes, potentially enabling denial of service attacks on long-running processes through sustained attacker-controlled input. Memory corruption and information disclosure do not occur.
GHSA-wx95-c6cv-8532
LOW
[nokogiri] Canonicalization failure in canonicalize methods returns empty string instead of raising an exception, allowing downstream libraries to accept invalid XML and bypass signature validation in SAML implementations.
GHSA-c4rq-3m3g-8wgx
LOW
[nokogiri] CSS selector tokenizer contains regular expressions vulnerable to ReDoS attacks on adversarial selectors, allowing attackers to cause exponential regex backtracking and denial of service through CSS parsing methods.
🔗 Related Tasks

@codecov

codecov Bot commented May 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@aikido-autofix

aikido-autofix Bot commented Jun 5, 2026

Copy link
Copy Markdown
Author

Closed by Aikido: a new AutoFix has been created → #293

@aikido-autofix aikido-autofix Bot closed this Jun 5, 2026
@aikido-autofix aikido-autofix Bot deleted the fix/AIK-14274-update-packages-41934357-5wlp branch June 5, 2026 23:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants