CVE-2019-5477: Arbitrary execution of code in Nokogiri
Summary
CVE-2019-5477: Nokogiri Command Injection Vulnerability. Affects nokogiri versions < 1.10.4. Fixed in 1.10.4. How to fix ↓
Also tracked for
- rexical · Debian:11
The same CVE-2019-5477 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nokogiri is a RubyGem that provides an interface for parsing and manipulating XML and HTML documents. It is widely used in Ruby applications for tasks such as web scraping, data extraction, and XML/HTML processing. Nokogiri relies on the Rexical gem to generate lexical scanner code for parsing CSS queries. However, versions of Nokogiri prior to v1.10.4 and Rexical prior to v1.0.7 are vulnerable to a command injection attack.
Vulnerability Detail
The vulnerability arises from the use of the undocumented method Nokogiri::CSS::Tokenizer#load_file with unsafe user input as the filename. This allows an attacker to execute arbitrary commands in a subprocess through Ruby's Kernel.open method. The vulnerability is present in code generated by Rexical v1.0.6 and earlier. The impact of this vulnerability is critical as it enables an attacker to execute arbitrary code on the affected system, potentially leading to remote code execution, data theft, or other malicious activities.
How To Fix
Latest published version: 1.19.4 as of 22 Oct 2026
gem install nokogiri -v 1.19.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.4
This is the first release that contains the fix.
gem install nokogiri -v 1.10.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to avoid using the Nokogiri::CSS::Tokenizer#load_file method with user-controlled input. Instead, use alternative methods for loading files that do not rely on user input, such as Nokogiri::HTML(File.read(filename)) or Nokogiri::XML(File.read(filename)).
Conclusion
In conclusion, the vulnerability in Nokogiri and Rexical allows for arbitrary code execution and poses a significant risk to the security of affected systems. It is crucial to upgrade to the fixed versions of Nokogiri (v1.10.4 or later) and Rexical (v1.0.7 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nokogiri →
FAQ
Nokogiri is a RubyGem that provides an interface for parsing and manipulating XML and HTML documents. It is commonly used in Ruby applications for tasks such as web scraping, data extraction, and XML/HTML processing.
Rexical is a gem used by Nokogiri to generate lexical scanner code for parsing CSS queries.
Command injection is a type of vulnerability where an attacker is able to execute arbitrary commands on a target system by injecting malicious input into a command that is executed by the system.
The vulnerability allows an attacker to execute arbitrary code on the affected system, which can lead to various malicious activities such as remote code execution, data theft, or unauthorized access.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nokogiri.
