CyberRota Analysis
AI-GeneratedNokogiri versions prior to 1.19.3 are vulnerable to regular expression denial of service (ReDoS) attacks due to flaws in the CSS selector tokenizer, which can be exploited through methods such as Node#css and Node#at_css. This vulnerability allows attackers to inject malicious CSS selectors, leading to potential service disruptions through exponential regex backtracking. Organizations using affected versions of Nokogiri should prioritize updating to version 1.19.3 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.
Related CVEs
Other vulnerabilities affecting the same vendor(s)