CVE intelligence

CVE-2026-57438

Vulnerability intelligence

Published Jun 25, 2026Sources checked Nov 12, 2026

6.6MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2026-57438 and is rated Medium severity with a CVSS score of 6.6. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Jun 30, 2026

CBL-Mariner Releases

Vendor-listed releases

1.19.4-1

CISA KEVNot listedBased on the latest collected catalog

EPSS0.1%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-57438?

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them.

If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory.

This vulnerability is fixed in 1.19.4.

Source: NVD