Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability GHSA-5jhf-fpp7-v2pv is a duplicate of GHSA-c4rq-3m3g-8wgx, which describes a Regular Expression Denial of Service (ReDoS) in Nokogiri's CSS selector tokenizer. The affected versions are < 1.19.3, with 1.19.3 being the first patched version. The advisory explicitly mentions that the ReDoS affects string-literal and identifier tokenization and lists several public methods (Nokogiri::CSS.xpath_for, Node#css, Node#at_css, Searchable#search, CSS::Parser#parse) that funnel through the vulnerable tokenizer.
To identify the vulnerable functions, I first retrieved the commit SHA for version v1.19.3 (c139a3da0fe0cae7499a0bafa20f2875877c585b) and compared it with the previous version v1.19.2 (6f5d025af4d2721248095258d98a481839ec79de). This comparison revealed two key commits directly addressing the ReDoS:
00926231e28d5a20e5b4873efba36099aea0d5c6: 'fix: ReDoS in CSS tokenizer STRING rule'b984b7e47f622d1aa97d54c16d5cd596c3eb9538: 'fix: ReDoS in CSS tokenizer ident rule'Both commits modify lib/nokogiri/css/tokenizer.rb and lib/nokogiri/css/tokenizer.rex. The tokenizer.rex file defines the lexical rules, which are then used to generate tokenizer.rb. The _next_token method in lib/nokogiri/css/tokenizer.rb is where these regular expressions are actually executed to tokenize the input.
The patches show that the vulnerable regular expressions within _next_token for STRING, FUNCTION, IDENT, and HASH tokens were modified. The core of the fix involves introducing atomic groups (?>...) into the regex patterns. Atomic groups prevent the regex engine from backtracking into the grouped subexpression once it has matched, thereby eliminating the exponential complexity that led to the ReDoS. The removal of (?<!\\)(?:\\{2})* and adjustments to character classes further contribute to the fix.
Therefore, the Nokogiri::CSS::Tokenizer._next_token function is the precise vulnerable function because it directly contains and executes the inefficient regular expressions that cause the ReDoS when processing malicious CSS selector input. An attacker exploiting this vulnerability would trigger the execution of these specific regexes within this method, leading to a denial of service.
Nokogiri::CSS::Tokenizer._next_tokenlib/nokogiri/css/tokenizer.rb
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nokogiri | rubygems | < 1.19.3 |