CVE-2024-58377: Nokogiri libxml2 Information Disclosure

CVE-2024-58377 Overview

CVE-2024-58377 affects Nokogiri versions before 1.16.5, which bundle libxml2 2.12.6. The bundled libxml2 is affected by CVE-2024-34459, a flaw in the xmllint command-line tool. Nokogiri 1.16.5 upgrades the bundled libxml2 dependency to 2.12.7 to remediate the underlying issue.

According to the Nokogiri maintainers, there is no direct impact to Nokogiri users because Nokogiri does not provide or expose the xmllint binary where the flaw resides. The advisory exists to track the dependency upgrade and inform downstream consumers.

Critical Impact
The vulnerability is tracked under [CWE-427] (Uncontrolled Search Path Element) in the upstream libxml2 component, but the affected xmllint tool is not shipped by Nokogiri.

Affected Products

Nokogiri versions prior to 1.16.5
Bundled libxml2 version 2.12.6
Ruby applications that vendor Nokogiri with the bundled libxml2 build

Discovery Timeline

2026-08-25 - CVE-2024-58377 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2024-58377

Vulnerability Analysis

Nokogiri is a Ruby library for parsing HTML and XML documents. It ships with a vendored copy of libxml2 to guarantee consistent behavior across platforms. Versions before 1.16.5 bundle libxml2 2.12.6, which carries the upstream flaw tracked as CVE-2024-34459 in the xmllint command-line utility.

The upstream flaw resides in the xmllint binary distributed with libxml2. Nokogiri packages only the libxml2 library components required for its parsing APIs and does not install or expose the xmllint executable. As a result, the maintainers state that Nokogiri users are not exposed to the vulnerable code path in practice.

The advisory was published so that software composition analysis (SCA) tools and downstream consumers can align on a patched dependency baseline. Upgrading Nokogiri removes the vulnerable libxml2 build from the software bill of materials.

Root Cause

The root cause is the inclusion of libxml2 2.12.6 as a bundled dependency inside Nokogiri prior to 1.16.5. The upstream libxml2 issue is classified as [CWE-427] (Uncontrolled Search Path Element) affecting the xmllint tool. Nokogiri inherits the version metadata even though it does not ship the vulnerable binary.

Attack Vector

Direct exploitation against Nokogiri APIs is not feasible according to the maintainers, because the vulnerable xmllint binary is not distributed by the gem. Systems that separately install libxml2 from operating system packages and invoke xmllint remain subject to the upstream CVE-2024-34459 conditions. Applications should still track the bundled version to satisfy compliance and SCA scanning requirements.

No verified public exploit or proof-of-concept code is available for this advisory. See the GitHub Security Advisory GHSA-r95h-9x8f-r3f7 and the VulnCheck Advisory on Nokogiri for additional technical detail.

Detection Methods for CVE-2024-58377

Indicators of Compromise

Presence of the Nokogiri gem at versions below 1.16.5 in Gemfile.lock or vendored dependencies
Bundled libxml2 reporting version 2.12.6 when queried via Nokogiri::VERSION_INFO
SCA scanner findings referencing GHSA-r95h-9x8f-r3f7 or CVE-2024-34459 against Ruby projects

Detection Strategies

Run bundle list nokogiri and bundle outdated nokogiri across Ruby projects to enumerate vulnerable installations.
Inspect application runtime output of Nokogiri::VERSION_INFO to confirm the bundled libxml2 version in production images.
Include CVE-2024-58377 and CVE-2024-34459 in SCA policy rules to flag builds that pin Nokogiri below 1.16.5.

Monitoring Recommendations

Track dependency drift in CI pipelines and fail builds that resolve Nokogiri below 1.16.5.
Monitor container registries for images that embed vulnerable Nokogiri versions and rebuild from patched base layers.
Correlate SBOM data with vulnerability feeds to surface any downstream libraries that pin the affected release.

How to Mitigate CVE-2024-58377

Immediate Actions Required

Upgrade Nokogiri to 1.16.5 or later, which bundles libxml2 2.12.7.
Rebuild container images and application artifacts to ensure the patched gem is installed rather than cached.
Update SCA and dependency policies to prohibit Nokogiri versions below 1.16.5.

Patch Information

The fix landed in Nokogiri 1.16.5, which upgrades the bundled libxml2 dependency to 2.12.7. Review the upstream change in the Nokogiri commit 2876ac53 and the GitHub Security Advisory GHSA-r95h-9x8f-r3f7 for full details.

Workarounds

Configure Nokogiri to link against a system-provided, patched libxml2 build using the --use-system-libraries install option where operationally viable.
Restrict any separate installations of xmllint on production hosts, since the vulnerable behavior lives in that upstream binary rather than in Nokogiri itself.
If upgrade is temporarily blocked, document the exception in the SBOM and prevent invocation of external xmllint from application workflows.

bash

# Configuration example
bundle update nokogiri --conservative
bundle exec ruby -rnokogiri -e 'pp Nokogiri::VERSION_INFO'
# Expect: bundled libxml2 version 2.12.7 or later, Nokogiri >= 1.16.5