Nokogiri Vendored libxml2/libxslt Vulnerabilities (CVE-2022-51000)

Technical Analysis

The flaw stems from two upstream vulnerabilities bundled into Nokogiri's packaged libraries: CVE-2021-30560 in libxslt allows a denial-of-service attack when transforming XML using untrusted XSL stylesheets, and CVE-2022-23308 in libxml2 can result in denial of service, memory disclosure, or code execution when parsing untrusted documents with DTDVALID enabled and NOENT disabled. Exploitation requires an application to pass attacker-controlled XML or XSL content into Nokogiri's parsing/transformation functions with vulnerable configuration options set. The fix upgrades vendored libxml2 to 2.9.13 and libxslt to 1.1.35, closing both memory-safety and DoS vectors. Because Nokogiri is a foundational dependency for many Ruby-based web scraping, data ingestion, and document-processing tools, this creates a supply-chain risk across the broader Ruby ecosystem. AI agent systems that use Ruby-based tooling for RAG document ingestion, web scraping, or XML/HTML parsing of untrusted external content (e.g., scraped web pages, API responses, or user-uploaded documents) could be exposed to crashes, information disclosure of in-memory data, or potential code execution if they rely on outdated Nokogiri builds within their pipelines.

Affected Systems

Nokogiri gem versions prior to 1.13.2 for CRuby using packaged/vendored libxml2 (2.9.12) and libxslt (1.1.34); any Ruby application, service, or agent pipeline that parses or transforms untrusted XML/XSL content via Nokogiri.

Indicators of Compromise

• N/A - vulnerability advisory, no known active exploitation IOCs published

Remediation Steps

1. 1

   Upgrade Nokogiri

   Update Nokogiri to version 1.13.2 or later, which includes patched vendored libxml2 (2.9.13) and libxslt (1.1.35).

2. 2

   Audit XML Parsing Configuration

   Review application code for XML parsing calls that set DTDVALID to true and NOENT to false; disable these options or validate that only trusted input is processed with them.

3. 3

   Restrict Untrusted XSL Transformations

   Avoid applying XSL stylesheets from untrusted sources; sandbox or rate-limit transformation operations to mitigate DoS risk.

4. 4

   Dependency Scanning

   Run software composition analysis (SCA) tools across Ruby-based agent pipelines, RAG ingestion services, and scraping tools to identify vulnerable Nokogiri versions.

5. 5

   Monitor for Anomalous Resource Usage

   Implement monitoring for unusual CPU/memory spikes during XML parsing operations, which could indicate DoS exploitation attempts.