GHSA-mrxw-mxhj-p664: Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs
(updated )
Nokogiri v1.18.4 upgrades its dependency libxslt to v1.1.43.
libxslt v1.1.43 resolves:
- CVE-2025-24855: Fix use-after-free of XPath context node
- CVE-2024-55549: Fix UAF related to excluded namespaces
References
- github.com/advisories/GHSA-mrxw-mxhj-p664
- github.com/sparklemotion/nokogiri
- github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664
- gitlab.gnome.org/GNOME/libxslt/-/issues/127
- gitlab.gnome.org/GNOME/libxslt/-/issues/128
- nvd.nist.gov/vuln/detail/CVE-2024-55549
- nvd.nist.gov/vuln/detail/CVE-2025-24855
Code Behaviors & Features
Detect and mitigate GHSA-mrxw-mxhj-p664 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →