GHSA-5mwf-688x-mr7x: Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

February 19, 2025 (updated March 10, 2025)

Nokogiri v1.18.3 upgrades its dependency libxml2 to v2.13.6.

libxml2 v2.13.6 addresses:

CVE-2025-24928
described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
CVE-2024-56171
described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828

References

github.com/advisories/GHSA-5mwf-688x-mr7x
github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml
github.com/sparklemotion/nokogiri
github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m

Code Behaviors & Features

Detect and mitigate GHSA-5mwf-688x-mr7x with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →