Type confusion in `xsltNumberFormatGetMultipleLevel` prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.

Nokogiri prior to version 1.10.5 contains a vulnerable version of libxslt. Nokogiri version 1.10.5 upgrades the dependency to libxslt 1.1.34, which contains a patch for this issue.

Affected Packages

RubyGems nokogiri

Affected versions: 0 (fixed in 1.10.5)

Related CVEs

CVE-2019-5815

Key Information

GHSA ID

GHSA-vmfx-gcfq-wvm2

Published

May 24, 2022 5:03 PM

Last Modified

July 10, 2023 1:05 PM

CVSS Score

7.5 /10

Primary Ecosystem

RubyGems

Primary Package

nokogiri

GitHub Reviewed

✓ Yes

Dataset

Last updated: November 25, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.