Nokogiri, a Ruby XML library, ships with bundled versions of libxml2 and libxslt that are vulnerable to two upstream flaws. The libxslt defect (CVE‑2021‑30560) permits a denial‑of‑service when an application applies untrusted XSL stylesheets. The libxml2 defect (CVE‑2022‑23308) can lead to denial of service, memory disclosure, or code execution when parsing an untrusted document with DTD validation enabled and entity expansion disabled. These weaknesses arise from improper memory handling (CWE‑416) and can be triggered by externally supplied XML or XSL content, potentially giving an attacker high‑impact influence over the target application. The combined effect is a high‑severity exploit that threatens confidentiality, integrity, and availability of systems that rely on Nokogiri for XML processing.

The vulnerability affects any installation of the sparklemotion:nokogiri library with version numbers before 1.13.2 when the packaged libxml2 2.9.12 and libxslt 1.1.34 libraries are in use. This includes typical Rails, Sinatra, and other Ruby applications that depend on Nokogiri for XML parsing or XSL transformation, provided they are not configured to use system‑provided XML libraries instead of the bundled ones.

The CVSS score of 9.3 indicates critical severity and the lack of an available EPSS score does not mitigate the risk posed by the known exploitability of the underlying C library flaws. Because the CVE is not listed in CISA’s KEV catalog, no active known exploits are documented at this time, but the high score and the nature of the flaws suggest that exploitation could be accomplished by providing crafted XML or XSL files to a vulnerable application. The likely attack vector is an attacker who can influence the input to the Nokogiri parser—either through network‑exposed APIs or third‑party data ingestion. Given the severity, administrators should treat this as a high‑risk issue until patched.