-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing type validation in SAX parser entry points. The commit db05ba9 adds explicit type checks (Check_Type in C, instanceof checks in Java, === String in Ruby) to these functions. The CVE description explicitly calls out XML/HTML4 SAX parser context handling, and the patch changes show these functions were previously vulnerable to type confusion via non-String/non-IO inputs. CRuby's RSTRING_* macros crash when applied to non-String objects, leading to segfaults. The high confidence comes from direct correlation between patched functions and vulnerability description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nokogiri | rubygems | < 1.13.6 | 1.13.6 |