A critical use-after-free vulnerability in the Nokogiri library can lead to arbitrary code execution when parsing malicious XML content.

This is a use-after-free vulnerability (CWE-416) within the libxml2 library used by Nokogiri. The flaw is triggered during XML parsing when specific features like DTD validation and XInclude expansion are active, allowing an unauthenticated attacker to cause a memory corruption event.

Exploitation of this memory corruption flaw can result in application crashes or, more severely, arbitrary code execution with the privileges of the application process. With a CVSS score of 9.8, this vulnerability poses a severe risk to any system that parses untrusted XML data, potentially leading to full system compromise.

Immediate Action: Update Nokogiri to version 1.15.6 or 1.16.2 to incorporate the patched libxml2 library.

Proactive Monitoring: Monitor application logs for unexpected crashes or error patterns occurring during XML parsing tasks, which may indicate exploitation attempts.

Compensating Controls: Disable DTD validation and XInclude expansion features if they are not strictly required for business operations, as this effectively neutralizes the attack vector.

Public Exploit Available: Unknown

Organizations utilizing Nokogiri for XML processing should treat this as a high-priority update. Upgrading to the recommended versions is the most effective way to secure the application against potential memory-based attacks.