GHSA-5v8h-3h3q-446p
LowSummary
A vulnerability in the Nokogiri library allows calling `Document#encoding=` with an invalid encoding (e.g., a non-string or a string containing a null byte), which frees the document's current encoding string without replacing it. The document is left referencing freed memory, leading to a use-after-free condition on the next call.
Risk Assessment
The risk involves potential remote code execution or application crash when processing XML/HTML documents via Nokogiri. An attacker can supply a specially crafted document to trigger this vulnerability, leading to data integrity compromise or denial of service.
Recommendation
It is recommended to immediately update the Nokogiri library to a version that fixes this vulnerability. Also avoid passing invalid values to the `encoding=` method and implement input validation.
Original NVD description (English source)
### Summary Calling `Document#encoding=` with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to `Doc