Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
SeverityThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.0)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/MAV:N/MAC:L) for JRuby users. (This security advisory does not apply to CRuby users.)ImpactIn Nokogiri v1.12.4 and earlier, **on JRuby only**, the SAX parser resolves external entities by default.Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:Nokogiri::XML::SAX::ParserNokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::ParserNokogiri::XML::SAX::PushParserNokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParserMitigationJRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.CRuby users are not affected.