CVE-2026-57438

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.

• CWE-416

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wfpw-mmfh-qq69Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57432Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-R…8.4
• CVE-2026-57433Storable versions before 3.41 for Perl have a signed integer…9.8
• CVE-2026-57434Nokogiri is an open source XML and HTML library for the Ruby…7.5
• CVE-2026-57435Nokogiri is an open source XML and HTML library for the Ruby…7.5
• CVE-2026-57436Nokogiri is an open source XML and HTML library for the Ruby…5.3
• CVE-2026-57437Nokogiri is an open source XML and HTML library for the Ruby…5.3
• CVE-2026-57439CyberChef is a web app for encryption, encoding, compression…5
• CVE-2026-57440The EmbedVideo Extension is a MediaWiki extension which adds…7.5
• CVE-2026-57441MCPVault is a lightweight Model Context Protocol server for …8.4
• CVE-2026-57442MCPVault is a lightweight Model Context Protocol server for …6.9
• CVE-2026-57443SCBE-AETHERMOORE is a geometric AI governance and evaluation…7.5
• CVE-2026-57445Gardens v2 is a modular governance framework that enables co…8.7