Nokogiri has vulnerable dependencies on libxml2 and libxslt
Date: 2022-05
Affected: rubygems/nokogiri
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2019-5815
CVE-2021-30560
CWE: CWE-416
CWE-787
CWE-843
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Mitigations:

Architectural layers (MAESTRO):