CVE-2022-23476: nokogiri Unchecked Return Value

Vulnerability summary

CVE-2022-23476 is a high (CVSS 7.5) Unchecked Return Value vulnerability in nokogiri. EPSS estimates a 1.82% chance of exploitation in the next 30 days, higher than 78.4% of scored vulnerabilities.

Timeline

1. 08-12-2022
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.

• CWE-252Unchecked Return ValueThe product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.