CVE-2019-13118
HIGH
libxslt Type Confusion vulnerability that affects Nokogiri
Published May 24, 2022Updated June 9, 2026Source: osv
Summary
In `numbers.c` in libxslt 1.1.33, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data.
Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.
Remediation
Upgrade to the fixed version using your package manager.
Bundler
Update nokogiri to 1.10.5 or latergem install nokogiri -v 1.10.5
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (1)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| nokogiri | rubygems | 1.0.0, 1.0.1, 1.0.2, 1.0.3 (+110 more) | 1.10.5 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-843
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-13118ADVISORY
- https://github.com/sparklemotion/nokogiri/issues/1943WEB
- https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173eWEB
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069WEB
- https://seclists.org/bugtraq/2019/Jul/36WEB
- https://seclists.org/bugtraq/2019/Jul/37WEB
- https://seclists.org/bugtraq/2019/Jul/40WEB
- https://seclists.org/bugtraq/2019/Jul/41WEB
- https://seclists.org/bugtraq/2019/Jul/42WEB
- https://security.netapp.com/advisory/ntap-20190806-0004WEB
- https://security.netapp.com/advisory/ntap-20200122-0003WEB
- https://support.apple.com/kb/HT210346WEB
- https://support.apple.com/kb/HT210348WEB
- https://support.apple.com/kb/HT210351WEB
- https://support.apple.com/kb/HT210353WEB
- https://support.apple.com/kb/HT210356WEB
- https://support.apple.com/kb/HT210357WEB
- https://support.apple.com/kb/HT210358WEB
- https://usn.ubuntu.com/4164-1WEB
- https://www.oracle.com/security-alerts/cpujan2020.htmlWEB
- https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796WEB
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5WEB
- https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71bWEB
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3EWEB
- https://lists.debian.org/debian-lts-announce/2019/07/msg00020.htmlWEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZWEB
- https://oss-fuzz.com/testcase-detail/5197371471822848WEB
- https://seclists.org/bugtraq/2019/Aug/21WEB
- https://seclists.org/bugtraq/2019/Aug/22WEB
- https://seclists.org/bugtraq/2019/Aug/23WEB
- https://seclists.org/bugtraq/2019/Aug/25WEB
- https://seclists.org/bugtraq/2019/Jul/35WEB
- https://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.htmlWEB
- https://seclists.org/fulldisclosure/2019/Aug/11WEB
- https://seclists.org/fulldisclosure/2019/Aug/13WEB
- https://seclists.org/fulldisclosure/2019/Aug/14WEB
- https://seclists.org/fulldisclosure/2019/Aug/15WEB
- https://seclists.org/fulldisclosure/2019/Jul/22WEB
- https://seclists.org/fulldisclosure/2019/Jul/23WEB
- https://seclists.org/fulldisclosure/2019/Jul/24WEB
- https://seclists.org/fulldisclosure/2019/Jul/26WEB
- https://seclists.org/fulldisclosure/2019/Jul/31WEB
- https://seclists.org/fulldisclosure/2019/Jul/37WEB
- https://seclists.org/fulldisclosure/2019/Jul/38WEB
- https://www.openwall.com/lists/oss-security/2019/11/17/2WEB
Frequently Asked Questions
- What is CVE-2019-13118?
- libxslt Type Confusion vulnerability that affects Nokogiri This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
- How do I check if my project is affected by CVE-2019-13118?
- CVE-2019-13118 affects nokogiri. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-13118 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
7.5
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-cf46-6xxh-pc75
Related CVEs
- CVE-2012-6685HIGH
Nokogiri is vulnerable to XML External Entity (XXE) attack
- CVE-2020-7595HIGH
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
- CVE-2015-8806HIGH
Denial of service or RCE from libxml2 and libxslt
- GHSA-c4rq-3m3g-8wgxHIGH
Nokogiri CSS selector tokenizer has regular expression backtracking
- CVE-2013-6460MEDIUM
Nokogiri vulnerable to DoS while parsing XML documents
- CVE-2017-18258MEDIUM
Uncontrolled resource consumption in nokogiri
- CVE-2026-57236LOW
Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
- CVE-2026-57434LOW
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies