GHSA-vvfq-8hwr-qm4m: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

February 18, 2025 (updated March 10, 2025)

Nokogiri v1.18.3 upgrades its dependency libxml2 to v2.13.6.

libxml2 v2.13.6 addresses:

CVE-2025-24928
described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
CVE-2024-56171
described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828

References

github.com/advisories/GHSA-vvfq-8hwr-qm4m
github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml
github.com/sparklemotion/nokogiri
github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m

Code Behaviors & Features

Detect and mitigate GHSA-vvfq-8hwr-qm4m with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →