Nokogiri CSS Selector Tokenizer Vulnerability: Regular Expression Denial of Service
Summary
GHSA-5jhf-fpp7-v2pv: Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking. Affects nokogiri versions 1.0.0 – 1.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nokogiri is a widely-used Ruby library for parsing HTML and XML. It provides a simple and efficient way to manipulate and search documents using CSS selectors and XPath. However, versions prior to 1.19.3 are vulnerable to a specific denial of service attack due to issues in the CSS selector tokenizer, which can be exploited by attackers to cause significant performance degradation.
Vulnerability Detail
The vulnerability arises from regular expression backtracking in the CSS selector tokenizer of Nokogiri versions before 1.19.3. Attackers can craft malicious CSS selectors that, when processed by methods like Node#css, Node#at_css, and Searchable#search, lead to exponential backtracking in regex processing. This can result in denial of service, making the application unresponsive and affecting user experience.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update Nokogiri immediately, consider sanitizing user input to prevent the injection of malicious CSS selectors. Implementing strict validation on the input can help mitigate the risk until an update can be applied.
Conclusion
The Nokogiri CSS selector tokenizer vulnerability poses a significant risk due to its potential for denial of service attacks. It is crucial for users of Nokogiri to update to version 1.19.3 or later to mitigate this risk. Additionally, employing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for nokogiri →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Nokogiri versions prior to 1.19.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to denial of service, causing the application to become unresponsive and negatively impacting user experience.
Yes, you can implement input validation to sanitize user inputs and prevent the injection of malicious CSS selectors as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for nokogiri.
