GHSA-wfpw-mmfh-qq69
LowSummary
The vulnerability in the Nokogiri library affects the `Nokogiri::XML::Node#do_xinclude` method, which during XInclude processing removes `<xi:include>` nodes along with their children (e.g., `<xi:fallback>`) and declared namespaces. If an application previously accessed these nodes, unexpected behavior may occur.
Risk Assessment
The risk involves potential data integrity issues or application malfunction if previously stored references to removed XML nodes are used after XInclude processing.
Recommendation
It is recommended to update the Nokogiri library to the latest version that includes a fix for this vulnerability. Also, avoid storing references to XML nodes before performing XInclude.
Original NVD description (English source)
### Summary XInclude substitution performed by `Nokogiri::XML::Node#do_xinclude` replaced each `<xi:include>` in place, freeing the include node along with its children (such as `<xi:fallback>` and its descendants) and any namespaces declared on them. If an application had already exposed one of th