{"action":"Upgrade nokogiri to 1.11.0 or later.","affected":[{"fixed":"1.11.0","introduced":"0"}],"component":"nokogiri","cve_ids":["CVE-2020-26247"],"ecosystem":"RubyGems","epss":0.01181,"exploited":false,"fixed_versions":["1.11.0"],"ghsa_id":"GHSA-vr8q-g5c7-m54m","id":"tcs_01M5KENNCVPX9D9763DJ92R7TG","modified_at":"2026-07-08T05:59:36.466993913Z","published_at":"2020-12-30T18:35:06Z","references":["https://osv.dev/vulnerability/GHSA-vr8q-g5c7-m54m","https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m","https://nvd.nist.gov/vuln/detail/CVE-2020-26247","https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b","https://hackerone.com/reports/747489","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-26247.yml","https://github.com/sparklemotion/nokogiri","https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md#v1110--2021-01-03","https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4","https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html","https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html","https://rubygems.org/gems/nokogiri","https://security.gentoo.org/glsa/202208-29"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-vr8q-g5c7-m54m","url":"https://osv.dev/vulnerability/GHSA-vr8q-g5c7-m54m"}],"summary":"Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability"}