GHSA-8678-w3jw-xfc2
LowSummary
The vulnerability in the Nokogiri library for JRuby causes the NONET option to be incorrectly enforced when parsing XML schemas. This allows an attacker to load external network resources, potentially leading to data leakage or SSRF attacks.
Risk Assessment
The organization is at risk of unauthorized access to internal network resources and potential leakage of sensitive data through loading external entities during XML schema processing.
Recommendation
Immediately update the Nokogiri library to a version that includes a fix for this vulnerability. In the meantime, manually disable the NONET option or restrict network access for applications using JRuby.
Original NVD description (English source)
### Summary The `NONET` parse option, which Nokogiri turns on by default for `Nokogiri::XML::Schema` (see [CVE-2020-26247](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m)), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with d