Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
sparklemotion/nokogiri
main @ feec58a
59
Fixes
10
CVEs
CRITICAL
Peak severity
47.4%
Coverage
Highlights
Memory Corruption: 20 prior fixes. Scrutinize any change in this area.
ext/nokogiri/xml_node.c: most-fixed (8 issues). Treat as high-risk during review.
50 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Safety: Premature garbage collection of parent XML documents while active Ruby wrapper objects still point to child nodes has historically led to numerous use-after-free crashes. Preventing this requires explicit node pinning, dynamic document-level cache registration, and GC marking callbacks.
XML External Entity (XXE): In JRuby environments, SAX and DOM parsers historically failed to disable external entity resolution and external DTD loading by default. This led to high-severity XXE vulnerabilities like CVE-2021-41098.
Memory Safety: Implicit lifecycle management mismatch when removing nodes or namespaces from NodeSet structures has repeatedly caused use-after-free and double-free vulnerabilities when underlying structures are deallocated.