CVE-2026-57234: Nokogiri JRuby NONET Bypass Enables SSRF/XXE Attacks

Technical summary

The NONET (No Network) parse option in Nokogiri is designed to disable external resource resolution during XML/HTML schema parsing—a hardening measure introduced to address CVE-2020-26247. In the standard Ruby implementation, this restriction is enforced correctly. However, the JRuby version of Nokogiri does not properly enforce the NONET flag when parsing schemas with default options, allowing the underlying JRuby XML parser to still resolve external entities and fetch network resources. An authenticated user with the ability to influence which schema is parsed could exploit this to trigger SSRF attacks (forcing the server to contact internal or external targets) or XXE attacks (extracting data via entity expansion). The vulnerability requires both authentication and user interaction (schema selection), which constraints the attack surface.

Business impact

Organizations using Nokogiri on JRuby in production environments that parse untrusted XML schemas face potential information disclosure and lateral movement risks. If an attacker can provide or influence a schema file, they could trigger outbound requests to probe internal networks, access internal metadata services, or exfiltrate data embedded in XML responses. In containerized or cloud environments, this could lead to exposure of credentials or secrets stored in environment variables or metadata endpoints. The impact is amplified in multi-tenant systems where one tenant's malicious schema could compromise others. However, the requirement for authentication and user interaction limits the severity in typical deployments.

Affected systems

Ruby applications using Nokogiri versions prior to 1.19.4 on the JRuby runtime are affected. Standard Ruby (MRI) users are not vulnerable. The risk is highest in services that accept XML schema uploads or allow users to specify schema sources (e.g., API validation layers, data integration platforms, or XML processing microservices). JRuby deployments are less common than standard Ruby but are used in organizations leveraging Java Virtual Machine infrastructure or requiring Java interoperability.

Exploitability

Exploitation requires authentication and relies on user interaction—specifically, the ability to influence which schema is parsed or to provide a schema directly to the application. No remote unauthenticated attack is possible. The attacker must craft a schema file containing entity references or external DTD declarations designed to trigger network access. This is not an easy, one-click exploitation scenario; it demands application-level access and knowledge of how the target application processes schemas. The CVSS vector (AV:N/AC:H/PR:L/UI:R) reflects these constraints: network-accessible but high attack complexity, authenticated, and requiring user interaction.

Remediation

Upgrade Nokogiri to version 1.19.4 or later. For JRuby-dependent applications, this is a straightforward dependency bump in your Gemfile or gemspec. After patching, verify that your application no longer instantiates Nokogiri::XML::Schema with untrusted input, and consider implementing additional application-level controls such as schema validation, sandboxing, or allowlisting trusted schemas. Teams unable to upgrade immediately should restrict which users or systems can supply XML schemas to the application.

Patch guidance

Update the Nokogiri gem to 1.19.4 or any subsequent version. In a Gemfile, change `gem 'nokogiri'` to `gem 'nokogiri', '>= 1.19.4'` or pin to a specific patch like `gem 'nokogiri', '~> 1.19.4'`. Run `bundle update nokogiri` to install. Verify the new version with `bundle list nokogiri` and confirm your application uses JRuby (check `ruby --version` output for 'jruby'). Testing on a staging environment before production deployment is recommended to ensure no behavioral changes affect schema validation workflows.

Detection guidance

Monitor application logs for unusual schema parsing activity or external network connections initiated during XML schema processing. If using JRuby, search your dependency manifest (Gemfile.lock) for Nokogiri versions < 1.19.4. Establish a code review checklist to flag any application code that passes user-supplied input directly to Nokogiri::XML::Schema.new(). Network monitoring tools can detect outbound connections from application servers that occur during schema parsing—anomalies warrant investigation. In CI/CD pipelines, add a step to verify Nokogiri version and fail builds if a vulnerable version is detected.

Why prioritize this

Despite a low CVSS score, this vulnerability merits attention for JRuby shops because it undermines a deliberate security control (NONET). The disclosure corrects a regression—the feature was supposed to prevent exactly this attack. Any organization relying on schema parsing as a security boundary should prioritize patching. However, this is not an emergency patch for MRI-only shops or applications that never parse untrusted schemas. Prioritization should be risk-based: high for JRuby users with user-supplied schemas, low for closed environments with static, trusted schemas.

Risk score, explained

The CVSS score of 2.6 (LOW) reflects a narrow attack surface: authentication is required, attack complexity is high, and user interaction is necessary. The impact is limited to confidentiality (potential data leak); integrity and availability are not affected. However, this score does not capture the contextual severity—in applications where schema injection is feasible, the actual risk is higher. The CWE references (CWE-178 Improper Handling of Case Sensitivity, CWE-184 Incomplete List of Disallowed Inputs, CWE-611 Improper Restriction of XML External Entity Reference) underscore the nature of the flaw: a logic error in enforcing restrictions across runtime implementations.

Frequently asked questions