-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises in libxml2's XML Reader (xmlTextReader) when DTD validation and XInclude are enabled. The patch commit (92721970) modifies xmlTextReaderValidatePop in xmlreader.c to add a NULL check for valid->vstate before calling xmlValidatePopElement. This indicates that the missing check in xmlTextReaderValidatePop allowed a freed validity state to be passed to xmlValidatePopElement, causing a use-after-free. Both functions are directly involved: xmlTextReaderValidatePop for failing to validate the state, and xmlValidatePopElement for operating on an invalid pointer. The CVE description explicitly references xmlValidatePopElement, and the commit confirms the code path in xmlTextReader.
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nokogiri | rubygems | < 1.15.6 | 1.15.6 |
| nokogiri | rubygems | >= 1.16.0, < 1.16.2 | 1.16.2 |
Ongoing coverage of React2Shell