CVE-2025-24855: Use-After-Free in Nokogiri

The use-after-free vulnerability in libxslt, as exploited through Nokogiri, allows an attacker to potentially execute arbitrary code on a vulnerable system. This occurs due to improper handling of XPath context nodes, leading to memory corruption. Successful exploitation could allow an attacker to gain control of the application server, access sensitive data, or even compromise the entire system. The MITRE assessment highlights potential for high impact, including confidentiality and integrity compromises, and the ability to achieve remote code execution with no user interaction. This vulnerability shares similarities with other memory corruption exploits, where attackers can manipulate memory to achieve unauthorized access or control.

1. Reserved2025-01-26
2. Published2025-03-14
3. Modified2026-02-26
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-24855 is to upgrade Nokogiri to version 1.18.4 or later. If an immediate upgrade is not feasible due to compatibility issues, consider temporarily isolating vulnerable systems or implementing stricter network controls to limit potential attack vectors. While a direct workaround is not available, implementing Web Application Firewall (WAF) rules to filter potentially malicious XPath expressions could provide a temporary layer of defense. After upgrading, verify the fix by attempting to trigger the XPath evaluation that previously exposed the vulnerability and confirming that no errors or crashes occur.