[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ9Mjr6ZdFEcaIHsbAeoJPIS0rKfAUXm3ROAo7a5JgbE":3,"g5a-risk:CVE-2022-23476":116},{"success":4,"data":5,"meta":113},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":33,"epssPercentile":26,"epssTimeSeries":34,"severity":35,"affectedProducts":36,"affectedProductsCount":44,"references":45,"referencesCount":58,"weaknesses":59,"weaknessesCount":44,"isActivelyExploited":74,"cisaInfo":26,"otxData":26,"relatedBlogPosts":75,"seoMetadata":76,"configurations":101,"relatedVendorCves":111,"notableEvents":112},"CVE-2022-23476","What is CVE-2022-23476?","Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.","Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTex...","2022-12-08T04:15:09.043","2022-12-10T03:10:55.453",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":26,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":27,"ImpactScore":28},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},0.01823,[33,33,33,33,33,33,33],"High",[37,41],{"vendor":38,"product":38,"version":39,"criteria":40,"vulnerable":4},"nokogiri","1.13.8","cpe:2.3:a:nokogiri:nokogiri:1.13.8:*:*:*:*:ruby:*:*",{"vendor":38,"product":38,"version":42,"criteria":43,"vulnerable":4},"1.13.9","cpe:2.3:a:nokogiri:nokogiri:1.13.9:*:*:*:*:ruby:*:*",2,[46,52,55],{"url":47,"source":48,"tags":49},"https:\u002F\u002Fgithub.com\u002Fsparklemotion\u002Fnokogiri\u002Fcommit\u002F85410e38410f670cbbc8c5b00d07b843caee88ce","GitHub",[50,51],"Patch","Third Party Advisory",{"url":53,"source":48,"tags":54},"https:\u002F\u002Fgithub.com\u002Fsparklemotion\u002Fnokogiri\u002Fcommit\u002F9fe0761c47c0d4270d1a5220cfd25de080350d50",[50,51],{"url":56,"source":48,"tags":57},"https:\u002F\u002Fgithub.com\u002Fsparklemotion\u002Fnokogiri\u002Fsecurity\u002Fadvisories\u002FGHSA-qv4q-mr5r-qprj",[51],3,[60,68],{"id":61,"name":62,"description":63,"extendedDescription":64,"status":65,"abstraction":66,"structure":67},"CWE-252","Unchecked Return Value","The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.","Two common programmer assumptions are \"this function call can never fail\" and \"it doesn't matter if this function call fails\". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.","Draft","Base","Simple",{"id":69,"name":70,"description":71,"extendedDescription":72,"status":73,"abstraction":66,"structure":67},"CWE-476","NULL Pointer Dereference","The product dereferences a pointer that it expects to be valid but is NULL.","","Stable",false,[],{"title":77,"metaDescription":78,"keywords":79,"canonicalUrl":80,"structuredData":81},"What is CVE-2022-23476? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-23476, a high severity cyber security vulnerability from 2022. Nokogiri is an open source XML and HTML library for the Rub...","CVE-2022-23476, CVE-2022-23476 vulnerability, CVE-2022-23476 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, nokogiri security, nokogiri vulnerability","\u002Fwhat-is\u002Fcve-2022-23476",{"@context":82,"@type":83,"headline":77,"description":78,"datePublished":10,"dateModified":11,"author":84,"publisher":88,"about":92,"mainEntityOfPage":96,"articleSection":99,"keywords":100},"https:\u002F\u002Fschema.org","TechArticle",{"@type":85,"name":86,"url":87},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":85,"name":86,"url":87,"logo":89},{"@type":90,"url":91},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":93,"name":6,"description":94,"additionalType":95},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":97,"@id":98},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-23476","Cybersecurity","CVE-2022-23476, CVE-2022-23476 vulnerability, CVE-2022-23476 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[102],{"Operator":26,"Negate":26,"Nodes":103},[104],{"Operator":105,"Negate":26,"CPEMatch":106},"OR",[107,109],{"Vulnerable":4,"Criteria":40,"MatchCriteriaID":108,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"5B720209-2ADC-4B12-8BEE-D5F827279B06",{"Vulnerable":4,"Criteria":43,"MatchCriteriaID":110,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"AA8BBC8F-F780-4359-81CA-EBB3A5767FB5",[],[],{"lastModified":11,"cacheTime":114,"version":115},1792257675287,"2.0",{"score":117,"band":118,"action":119,"scoredAt":120},42,"Medium","Plan remediation","2026-10-16T06:56:26.984893+00:00"]