Nokogiri versions prior to 1.18.3 are susceptible to memory corruption vulnerabilities that could lead to denial of service or arbitrary code execution.

The library suffers from a stack buffer overflow in libxml2 during DTD validation and a use-after-free vulnerability during XML Schema validation (CWE-787). An attacker can trigger these flaws by submitting specifically crafted XML or XSD files to an application using the affected library.

These memory corruption vulnerabilities pose a severe risk to applications that process untrusted XML data. Successful exploitation could lead to application crashes, causing denial of service, or potentially allow an attacker to execute arbitrary code within the context of the application. With a CVSS score of 9.8, this is a critical threat for any system relying on Nokogiri for XML processing.

Immediate Action: Update the sparklemotion nokogiri dependency to version 1.18.3 or later across all projects.

Proactive Monitoring: Monitor application error logs for frequent crashes or segmentation faults during XML processing tasks.

Compensating Controls: Implement strict input validation and sanitization for all incoming XML documents to ensure they conform to expected schemas before processing.

Public Exploit Available: No (exploit_available: false)

Software supply chain security is paramount in this case. Development teams should immediately audit their dependency manifests and update Nokogiri to version 1.18.3 to ensure their applications are protected against these memory corruption flaws.