CVE-2020-26247: 
Ruby vulnerability analysis and mitigation

Nokogiri, a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support, was found to contain an XXE vulnerability (CVE-2020-26247) in versions before 1.11.0.rc4. XML Schemas parsed by Nokogiri::XML::Schema were trusted by default, allowing external resources to be accessed over the network. This vulnerability was discovered and disclosed in December 2020, affecting all versions up to and including 1.11.0.rc3 (GitHub Advisory).

The vulnerability stems from XML Schemas being trusted by default when parsed by Nokogiri::XML::Schema, which could potentially enable XXE (XML External Entity) or SSRF (Server-Side Request Forgery) attacks. This behavior contradicted Nokogiri's security policy of treating all input as untrusted by default. The issue was evaluated as Low Severity with a CVSS score of 2.6 (GitHub Advisory).

The vulnerability could allow external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This could lead to unauthorized access to internal resources, data exfiltration, or service disruption (GitHub Advisory, Debian Advisory).

The vulnerability was independently reported by Eric Thérond and Corin Langosch through HackerOne. While specific exploit details are not publicly available, the risk was assessed as Low Severity due to the specific conditions required for exploitation (GitHub Advisory).

The vulnerability was fixed in Nokogiri version 1.11.0.rc4. Users should upgrade to this version or later. For those who need to maintain the previous behavior in v1.11.0.rc4 or later, they can pass an instance of Nokogiri::XML::ParseOptions with the NONET flag turned off to the Schema constructor, but this should only be done with trusted input (GitHub Advisory).

Multiple Linux distributions issued security advisories and patches for this vulnerability, including Debian and Red Hat. Debian classified it as a security update in their LTS announcement (Debian Advisory, Red Hat Advisory).