GHSA-5prr-v3j2-97mh
MediumSummary
A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.
Risk Assessment
An attacker could exploit this vulnerability to read memory outside the node set's storage, potentially leading to disclosure of sensitive data or application destabilization.
Recommendation
It is recommended to immediately update the Nokogiri library to the latest version that includes a fix for this vulnerability.
Original NVD description (English source)
### Summary `Nokogiri::XML::NodeSet#[]` (and its alias `#slice`) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is