NOKOGIRI · CVE-2026-126063 · Package
FIX → 1.19.5
Nokogiri's HTML5 serializer does not escape text inside noscript elements or angle brackets in attribute values, so a browser can parse the output into markup the parser never produced. An attacker who can supply HTML that an app sanitizes and serializes with Nokogiri::HTML5, while allowing noscript, can run script in a victim's browser.
first public Nov 2, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers. Loofah, rails-html-sanitizer and Sanitize do not allow noscript by default, and Sanitize always removes it, so apps relying only on those are less exposed. Only the C extension on CRuby and TruffleRuby is affected; JRuby does not implement Nokogiri::HTML5.
Not affected if default-sanitizer-config, jruby, no-noscript-allowed, sanitize-gem
Who cares html-sanitization, nokogiri, rails, ruby
Unknown from the sources.
Upgrade to 1.19.5
nokogiri to 1.19.5 or later.noscript should parse with parse_noscript_content_as_text: true (available since ) or remove elements, as the sources recommend on every version.Nokogiri's HTML5 serializer did not escape text inside noscript elements, or < and > inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.
Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parse_noscript_content_as_text: true.
Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5.
The Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). Exploitation requires an application that allows noscript in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.17.0noscriptUpgrade to Nokogiri 1.19.5 or later.
Applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true (available since Nokogiri 1.17.0), or remove noscript elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside noscript is serialized unchanged, as the standard requires.
This issue was responsibly reported by @a-zara-n.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.