deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wq4h-7r42-5hrr
Package: rack (RUBYGEMS)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: <= 2.0.9.0
Patched in: 2.0.9.1

Summary: Possible shell escape sequence injection vulnerability in Rack

Details:
There is a possible shell escape sequence injection vulnerability in the Lint
and CommonLogger components of Rack.  This vulnerability has been assigned the
CVE identifier CVE-2022-30123.

Versions Affected:  All.
Not affected:       None
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted requests can cause shell escape sequences to be written to
the terminal via Rack's Lint middleware and CommonLogger middleware.  These
escape sequences can be leveraged to possibly execute commands in the victim's
terminal.

Impacted applications will have either of these middleware installed, and
vulnerable apps may have something like this:

```
use Rack::Lint
```

Or

```
use Rack::CommonLogger
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

## Workarounds
Remove these middleware from your application
GitHub Security Advisory: GHSA-jj47-x69x-mxrm
Package: yajl-ruby (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-122: Heap-based Buffer Overflow, CWE-190: Integer Overflow or Wraparound
Vulnerable versions: <= 1.4.2
Patched in: 1.4.3

Summary: Buffer Overflow in yajl-ruby

Details:
_NOTE: A previous patch, 1.4.2, fixed the heap memory issue, but could still lead to a DoS infinite loop. Please update to version 1.4.3_

The 1.x branch and the 2.x branch of [yajl](https://github.com/lloyd/yajl) contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs.

### Details

The [reallocation logic at yajl_buf.c#L64](https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa[PII_REDACTED]6f968a93eb3a6/ext/yajl/yajl_buf.c#L64) may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk.

These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer.

Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption.

### Impact

We rate this as a moderate severity vulnerability which mostly impacts process availability as we believe exploitation for arbitrary code execution to be unlikely.

### Patches

Patched in yajl-ruby 1.4.3

### Workarounds

Avoid passing large inputs to YAJL

### References
https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa[PII_REDACTED]6f968a93eb3a6/ext/yajl/yajl_buf.c#L64

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [yajl-ruby](https://github.com/brianmario/yajl-ruby/issues)
GitHub Security Advisory: GHSA-ggfx-h9xj-5v9c
Package: random_password_generator (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-330: Use of Insufficiently Random Values, CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Vulnerable versions: <= 1.0.0
Patched in: unpatched

Summary: Insecure PRNG use in random_password_generator

Details:
The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
GitHub Security Advisory: GHSA-xh29-r2w5-wx8m
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 8.2)
CWE: CWE-241: Improper Handling of Unexpected Data Type, CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Vulnerable versions: < 1.13.6
Patched in: 1.13.6

Summary: Nokogiri Improperly Handles Unexpected Data Type

Details:
### Summary

Nokogiri `< v1.13.6` does not type-check all inputs into the XML and HTML4 SAX parsers. For CRuby users, this may allow specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory.

### Severity

The Nokogiri maintainers have evaluated this as **High 8.2** (CVSS3.1).


### Mitigation

CRuby users should upgrade to Nokogiri `>= 1.13.6`.

JRuby users are not affected.


### Workarounds

To avoid this vulnerability in affected applications, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.


### Credit

This vulnerability was responsibly reported by @agustingianni and the Github Security Lab.
GitHub Security Advisory: GHSA-cgx6-hpwq-fhv5
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 8.6)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 1.13.5
Patched in: 1.13.5

Summary: Integer Overflow or Wraparound in libxml2 affects Nokogiri

Details:
### Summary

Nokogiri v1.13.5 upgrades the packaged version of its dependency libxml2 from v2.9.13 to [v2.9.14](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14).

libxml2 v2.9.14 addresses [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824). This version also includes several security-related bug fixes for which CVEs were not created, including a potential double-free, potential memory leaks, and integer-overflow.

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.5`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.


### Mitigation

Upgrade to Nokogiri `>= 1.13.5`.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 `>= 2.9.14` which will also address these same issues.


### Impact

#### libxml2 [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)

- **CVSS3 score**:
  - Unspecified upstream
  - Nokogiri maintainers evaluate at 8.6 (High) ([CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)). Note that this is different from the CVSS assessed by NVD.
- **Type**: Denial of service, information disclosure
- **Description**: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a24

All versions of libml2 prior to v2.9.14 are affected.

Applications parsing or serializing multi-gigabyte documents (in excess of INT_MAX bytes) may be vulnerable to an integer overflow bug in buffer handling that could lead to exposure of confidential data, modification of unrelated data, or a segmentation fault resulting in a denial-of-service.


### References

- [libxml2 v2.9.14 release notes](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14)
- [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)
- [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer](https://cwe.mitre.org/data/definitions/119.html)
GitHub Security Advisory: GHSA-f55g-x8qq-2569
Package: csv-safe (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: CSV-Safe improperly filters special characters potentially leading to CSV injection

Details:
CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.
GitHub Security Advisory: GHSA-qp49-3pvw-x4m5
Package: sinatra (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-426: Untrusted Search Path
Vulnerable versions: < 2.2.0
Patched in: 2.2.0

Summary: sinatra does not validate expanded path matches

Details:
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
GitHub Security Advisory: GHSA-vx9g-377x-xwxq
Package: gibbon (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 3.4.4
Patched in: 3.4.4

Summary: Server side request forgery in gibbon

Details:
Gibbon v3.4.3 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. This issue has been resolved in version 3.4.4
GitHub Security Advisory: GHSA-qf9q-q4hh-qph3
Package: blazer (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 2.6.0
Patched in: 2.6.0

Summary: SQL injection in blazer

Details:
Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run.
GitHub Security Advisory: GHSA-69p6-wvmq-27gg
Package: git (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: < 1.11.0
Patched in: 1.11.0

Summary: Command injection in ruby-git

Details:
The package prior to v1.11.0 is vulnerable to Command Injection via git argument injection. When calling the `fetch(remote = 'origin', opts = {})` function, the remote parameter is passed to the `git fetch` subcommand in a way such that additional flags can be set. The additional flags can be used to perform a command injection.
GitHub Security Advisory: GHSA-ch3h-j2vf-95pv
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.0, <= 7.0.2.3
Patched in: 7.0.2.4

Summary: XSS Vulnerability in Action View tag helpers

Details:
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected:  ALL
Not affected:       NONE
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.

Impacted code will look something like this:

```
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.
GitHub Security Advisory: GHSA-ch3h-j2vf-95pv
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.1.0, <= 6.1.5.0
Patched in: 6.1.5.1

Summary: XSS Vulnerability in Action View tag helpers

Details:
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected:  ALL
Not affected:       NONE
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.

Impacted code will look something like this:

```
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.
GitHub Security Advisory: GHSA-ch3h-j2vf-95pv
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0, <= 6.0.4.7
Patched in: 6.0.4.8

Summary: XSS Vulnerability in Action View tag helpers

Details:
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected:  ALL
Not affected:       NONE
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.

Impacted code will look something like this:

```
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.
GitHub Security Advisory: GHSA-ch3h-j2vf-95pv
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 5.2.7.0
Patched in: 5.2.7.1

Summary: XSS Vulnerability in Action View tag helpers

Details:
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected:  ALL
Not affected:       NONE
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.

Impacted code will look something like this:

```
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.
GitHub Security Advisory: GHSA-mm33-5vfq-3mm3
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.0, <= 7.0.2.3
Patched in: 7.0.2.4

Summary: Cross-site Scripting Vulnerability in Action Pack

Details:
There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
assigned the CVE identifier CVE-2022-22577.

Versions Affected:  >= 5.2.0
Not affected:       < 5.2.0
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

CSP headers were only sent along with responses that Rails considered as
"HTML" responses.  This left API requests without CSP headers, which could
possibly expose users to XSS attacks.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Set a CSP for your API responses manually.
GitHub Security Advisory: GHSA-mm33-5vfq-3mm3
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.1.0, <= 6.1.5.0
Patched in: 6.1.5.1

Summary: Cross-site Scripting Vulnerability in Action Pack

Details:
There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
assigned the CVE identifier CVE-2022-22577.

Versions Affected:  >= 5.2.0
Not affected:       < 5.2.0
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

CSP headers were only sent along with responses that Rails considered as
"HTML" responses.  This left API requests without CSP headers, which could
possibly expose users to XSS attacks.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Set a CSP for your API responses manually.
GitHub Security Advisory: GHSA-mm33-5vfq-3mm3
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0, <= 6.0.4.7
Patched in: 6.0.4.8

Summary: Cross-site Scripting Vulnerability in Action Pack

Details:
There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
assigned the CVE identifier CVE-2022-22577.

Versions Affected:  >= 5.2.0
Not affected:       < 5.2.0
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

CSP headers were only sent along with responses that Rails considered as
"HTML" responses.  This left API requests without CSP headers, which could
possibly expose users to XSS attacks.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Set a CSP for your API responses manually.
GitHub Security Advisory: GHSA-mm33-5vfq-3mm3
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.2.0, <= 5.2.7.0
Patched in: 5.2.7.1

Summary: Cross-site Scripting Vulnerability in Action Pack

Details:
There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
assigned the CVE identifier CVE-2022-22577.

Versions Affected:  >= 5.2.0
Not affected:       < 5.2.0
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

CSP headers were only sent along with responses that Rails considered as
"HTML" responses.  This left API requests without CSP headers, which could
possibly expose users to XSS attacks.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Set a CSP for your API responses manually.
GitHub Security Advisory: GHSA-gx8x-g87m-h5q6
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.13.4
Patched in: 1.13.4

Summary: Denial of Service (DoS) in Nokogiri on JRuby

Details:
## Summary

Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).

See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.


## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Impact

### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml

- **Severity**: High 7.5
- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
GitHub Security Advisory: GHSA-xxx9-3xcr-gjj3
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: < 1.13.4
Patched in: 1.13.4

Summary: XML Injection in Xerces Java affects Nokogiri

Details:
## Summary

Nokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to 2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437). That CVE is scored as CVSS 6.5 "Medium" on the NVD record.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.

## Mitigation

Upgrade to Nokogiri `>= v1.13.4`.

## Impact

### [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) in xerces-J

- **Severity**: Medium
- **Type**: [CWE-91](https://cwe.mitre.org/data/definitions/91.html) XML Injection (aka Blind XPath Injection)
- **Description**: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
- **See also**: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
GitHub Security Advisory: GHSA-v6gp-9mmm-c6p5
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 1.13.4
Patched in: 1.13.4

Summary: Out-of-bounds Write in zlib affects Nokogiri

Details:
## Summary

Nokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032). That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.4`, and only if the packaged version of `zlib` is being used. Please see [this document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby) for a complete description of which platform gems vendor `zlib`. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `zlib` release announcements. 

## Mitigation

Upgrade to Nokogiri `>= v1.13.4`.

## Impact

### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) in zlib

- **Severity**: High
- **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html) Out of bounds write
- **Description**: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
GitHub Security Advisory: GHSA-crjr-9rc5-ghw8
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 1.13.4
Patched in: 1.13.4

Summary: Nokogiri Inefficient Regular Expression Complexity

Details:
## Summary

Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.

## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity


## Credit

This vulnerability was reported by HackerOne user ooooooo_q (ななおく).