Nokogiri libxml2 Use-After-Free (XML Reader / DTD Validation)

Technical Analysis

The flaw resides in libxml2's xmlValidatePopElement function, which can free and subsequently reference a stale pointer when the XML Reader interface processes a crafted document with DTD validation and XInclude expansion simultaneously enabled. This is a use-after-free (CWE-416) that can be triggered remotely by supplying malicious XML to any Ruby application parsing untrusted input via Nokogiri on CRuby with the packaged (vendored) libxml2; JRuby and builds linked against system libxml2 are not affected. Exploitation could result in denial of service or, in more severe scenarios, arbitrary code execution depending on heap layout and attacker control. Many AI agent frameworks, RAG pipelines, and web-scraping/data-ingestion tools written in Ruby depend on Nokogiri for parsing HTML/XML content retrieved from external or untrusted sources (e.g., scraped web pages, API responses, document ingestion), making this a plausible vector for compromising agent hosts that process attacker-supplied XML/HTML during automated tool use or content retrieval.

Affected Systems

Nokogiri gem before 1.15.6 and 1.16.x before 1.16.2 running on CRuby with the packaged/vendored libxml2; specifically applications using Nokogiri::XML::Reader with DTD validation and XInclude expansion enabled. JRuby and Nokogiri builds using system-installed libxml2 are not affected.

Indicators of Compromise

• N/A - vulnerability class, no known IOCs published
• Affected package: nokogiri (RubyGems)
• Underlying CVE: CVE-2024-25062 (libxml2)

Remediation Steps

1. 1

   Upgrade Nokogiri

   Update Nokogiri to version 1.15.6, 1.16.2, or later, which bundle patched libxml2 (2.11.7 or 2.12.5) resolving the use-after-free.

2. 2

   Use system libxml2 where possible

   Configure Nokogiri to link against a patched system libxml2 instead of the vendored copy, ensuring the OS package is updated to a version beyond CVE-2024-25062.

3. 3

   Restrict DTD validation and XInclude on untrusted input

   Disable or avoid combining DTD validation with XInclude expansion when parsing XML from untrusted or external sources until patched versions are deployed.

4. 4

   Audit dependency chains in agent/data pipelines

   Identify any AI agent, RAG, or automation frameworks that depend on Nokogiri (directly or transitively) for parsing scraped or ingested content, and prioritize patching those hosts given exposure to untrusted external data.

5. 5

   Monitor for crashes/anomalies

   Watch for unexpected crashes or memory errors in services parsing XML via Nokogiri, which may indicate exploitation attempts.