[GHSA-jc9r-qcgw-fxq9] A vulnerability was found in sparklemotion nokogiri up to...

[flavorjones]

Updates

• Affected products
• CVSS v3
• CVSS v4
• Description
• Severity
• Summary

Comments
I'm the maintainer and have officially disputed this CVE with the CNA, VulDB. They have updated the description to note the dispute and provide additional information. I've proposed adopting the updated description.

[Copilot]

Pull Request Overview

This PR updates the advisory metadata for GHSA-jc9r-qcgw-fxq9 to adopt a disputed description, refine affected version ranges, and adjust severity.

• Added a summary field and replaced details with a revised description noting the dispute and patch commit.
• Populated the affected section with package ecosystem and an introduced version range.
• Removed the old severity field and changed the final severity rating from “MODERATE” to “LOW”; updated the modified timestamp.

Comments suppressed due to low confidence (1)

advisories/unreviewed/2025/06/GHSA-jc9r-qcgw-fxq9/GHSA-jc9r-qcgw-fxq9.json:23

• The version range only specifies an 'introduced' event without a corresponding 'fixed' event. It's best practice to include a 'fixed' version or commit SHA to clearly indicate when the vulnerability was resolved.

              "introduced": "0"

[Copilot]

There are two 'severity' fields in this JSON (an empty array here and a string at the bottom), which can cause ambiguity. Consider removing the unused array to keep the metadata consistent.

Suggested change

"severity": [],

[Copilot]

[nitpick] The phrase 'An attack has to be approached locally' is unclear. Consider rephrasing to something like 'Exploitation requires local access' to improve readability.

Suggested change

"details": "A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is named ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.\n\n",

"details": "A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. Exploitation requires local access. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is named ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.\n\n",

[advisory-database]

Hi @flavorjones! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!