A security advisory for Nokogiri (CVE GHSA-wjv4-x9w8-wm3h) discloses a heap use-after-free vulnerability in the CRuby implementation. The flaw occurs when `Document#root=` is assigned a non-element node (e.g., a DTD node), which was previously allowed due to insufficient type validation. This can lead to an invalid memory read or segfault during garbage collection. Nokogiri 1.19.4 fixes the issue by restricting `Document#root=` to element nodes and raising a `TypeError` for any other type. The JRuby implementation was unaffected but received the same input validation for parity. Severity is rated low since it requires a programming error and cannot be triggered by untrusted input. The fix is to upgrade to Nokogiri >= 1.19.4.
294 Impressions