---
id: "CVE-2026-126063"
page: "https://infrastack.ai/live/CVE-2026-126063"
kind: "vulnerability"
aliases: ["CVE-2026-126063", "GHSA-4p39-36wj-23h4"]
title: "Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "nokogiri", "fixed": ["1.19.5"], "affected": ">= 1.12.0, < 1.19.5", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-116", "cwe-79", "html-sanitization", "nokogiri", "package", "rails", "ruby"]
not_affected_if: ["default-sanitizer-config", "jruby", "no-noscript-allowed", "sanitize-gem"]
published_at: "2026-11-10T20:47:36+00:00"
first_seen_at: "2026-11-10T20:51:58+00:00"
updated_at: "2026-11-10T21:46:15+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-4p39-36wj-23h4", "first_seen_at": "2026-11-10T20:51:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126063", "first_seen_at": "2026-11-10T21:46:15+00:00"}]
exploit_sources: []
---

# Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Link for people: https://infrastack.ai/live/CVE-2026-126063 (this .md is for agents)

Nokogiri's HTML5 serializer does not escape text inside noscript elements or angle brackets in attribute values, so a browser can parse the output into markup the parser never produced. An attacker who can supply HTML that an app sanitizes and serializes with Nokogiri::HTML5, while allowing noscript, can run script in a victim's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:nokogiri affected >= 1.12.0, < 1.19.5 fixed 1.19.5

## Fix

- Upgrade `nokogiri` to `1.19.5` or later.
- Applications that allow `noscript` should parse with `parse_noscript_content_as_text: true` (available since `1.17.0`) or remove `noscript` elements, as the sources recommend on every version.

## Timeline

- 2026-11-10T20:51:58+00:00 ghsa https://github.com/advisories/GHSA-4p39-36wj-23h4
- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126063

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/sparklemotion/nokogiri/security-advisories/GHSA-4p39-36wj-23h4
- [advisory] Maintainer's advisory: github.com https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4
- [fix] Patch: github.com https://github.com/sparklemotion/nokogiri/pull/3752
- [fix] Patch: github.com https://github.com/sparklemotion/nokogiri/commit/3e84df6ff7ab4d78f446e3a415430bd69a055d32
- [fix] Patch: github.com https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8
- [fix] Release notes: github.com https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5

## From the sources

### Summary

Nokogiri's HTML5 serializer did not escape text inside `noscript` elements, or `<` and `>` inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with `Nokogiri::HTML5`, allow `noscript` elements, and send the serialized output to browsers.

Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside `noscript` is still emitted unescaped for documents parsed with `parse_noscript_content_as_text: true`.

Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement `Nokogiri::HTML5`.

### Severity

The Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N`). Exploitation requires an application that allows `noscript` in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.

### Mitigation

Upgrade to Nokogiri 1.19.5 or later.

Applications that sanitize HTML and allow `noscript` should parse with `parse_noscript_content_as_text: true` (available since Nokogiri 1.17.0), or remove `noscript` elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside `noscript` is serialized unchanged, as the standard requires.

### Credit

This issue was responsibly reported by @a-zara-n.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_