GHSA-phwj-rprq-35pp

Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, `Nokogiri::XML::Attr#value=` could free the underlying native child node while the wrapper remains.

The risk involves a potential use-after-free vulnerability, which could lead to unpredictable application behavior, crashes, or potential remote code execution by an attacker.

It is recommended to immediately update Nokogiri to the latest patched version. Avoid using `Nokogiri::XML::Attr#value=` on attributes whose child nodes have been previously accessed until the update is applied.