Outdated dependencies in the sparklemotion nokogiri gem expose applications to critical security risks including remote code execution and denial of service.

The gem bundles vulnerable versions of libxml2 and libxslt. When an application processes untrusted XML or XSL content with specific parsing options, it becomes susceptible to memory corruption and potential code execution.

Applications using nokogiri to process user-supplied XML data are at significant risk of crash or compromise. With a CVSS score of 9.8, this flaw could lead to data exfiltration or total application takeover, causing severe operational and security impact.

Immediate Action: Update the nokogiri gem to version 1.13.2 or later to ensure the bundled libxml2 and libxslt libraries are patched.

Proactive Monitoring: Review applications that parse XML or XSL files and ensure that input validation is enforced before passing data to the parser.

Compensating Controls: Implement strict input validation and sandboxing for processes that handle untrusted XML documents to limit the impact of potential vulnerabilities.

Public Exploit Available: No confirmed public exploit available.

Developers should prioritize updating the nokogiri dependency to the latest version. Given the prevalence of this library in the Ruby ecosystem, this update should be integrated into standard maintenance cycles immediately to mitigate the risk of code execution.