A use‑after‑free flaw was discovered in libxml2, the XML parsing library bundled with Nokogiri. The bug is triggered through the xmlTextReader module when DTD validation and XInclude expansion are enabled. A crafted XML document can cause the xmlValidatePopElement function to free memory that is still in use, leading to a memory corruption condition that can be exploited by an attacker to execute arbitrary code. This vulnerability is identified as CWE‑416.

The issue affects the Nokogiri Ruby gem provided by Sparklemotion. Versions prior to 1.15.6 and prior to 1.16.2 contain the vulnerable libxml2 package. Applications built with CRuby that use Nokogiri’s XML Reader interface and enable DTD validation and XInclude expansion are susceptible. JRuby and installations that link against a system-installed libxml2 are not affected by this specific flaw.

The flaw is rated CVSS 9.3, indicating a high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation has not been observed in the wild yet. An attacker must supply a malicious XML file to a vulnerable application; thus the attack vector is likely to be local or remote depending on how the XML input is provided. Because the flaw leads to memory corruption, a successful exploit can result in arbitrary code execution on the host as which the application runs. Given the high CVSS score and the potential for complete control, the risk remains significant and patching is strongly advised.