[Aikido] Fix 15 security issues in nokogiri, loofah, sqlite3

[aikido-autofix]

Upgrade nokogiri, loofah, and sqlite3 to fix ReDoS, XXE/SSRF, canonicalization bypass, and memory safety vulnerabilities.

✅ 15 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-5prr-v3j2-97mh	LOW	[nokogiri] Out-of-bounds read vulnerability in NodeSet indexing allows attackers to pass large negative indices that bypass bounds checks, causing denial of service via process crash or potential memory disclosure. On CRuby, this results in an out-of-bounds read; on JRuby, it returns incorrect nodes.
GHSA-v2fc-qm4h-8hqv	LOW	[nokogiri] XSLT transform leaks small heap allocations when passed Ruby strings containing null bytes, potentially enabling denial of service attacks on long-running processes through sustained attacker-controlled input. Memory corruption and information disclosure do not occur.
GHSA-wx95-c6cv-8532	LOW	[nokogiri] Canonicalization failure in canonicalize methods returns empty string instead of raising an exception, allowing downstream libraries to accept invalid XML and bypass signature validation in SAML implementations.
GHSA-c4rq-3m3g-8wgx	LOW	[nokogiri] CSS selector tokenizer contains regular expressions vulnerable to ReDoS attacks on adversarial selectors, allowing attackers to cause exponential regex backtracking and denial of service through CSS parsing methods.
GHSA-8678-w3jw-xfc2	LOW	[nokogiri] JRuby implementation did not properly enforce the NONET parse option, allowing external resources to be fetched over the network and potentially enabling SSRF or XXE attacks on XML schemas parsed with default options.
GHSA-wfpw-mmfh-qq69	LOW	[nokogiri] XInclude substitution in do_xinclude freed nodes and namespaces that were already exposed to Ruby, leaving objects pointing at freed memory and causing potential invalid reads/writes. This affects CRuby only when XInclude is called after traversing the document tree.
GHSA-5v8h-3h3q-446p	LOW	[nokogiri] Setting an invalid encoding on a Document causes a use-after-free vulnerability, potentially leading to segfaults or memory disclosure. This requires an unusual API pattern of assigning invalid encoding, catching the exception, and continuing to use the document.
GHSA-9cv2-cfxc-v4v2	LOW	[nokogiri] NULL pointer dereference in native wrapper classes when calling methods on uninitialized objects allocated directly via .allocate, causing process crashes. This requires direct misuse of the API and cannot be triggered by untrusted input.
GHSA-p67v-3w7g-wjg7	LOW	[nokogiri] XPathContext did not keep its source document alive for garbage collection, potentially causing memory reads and segfaults if the document was collected while the context remained in use. This only affects direct XPathContext construction with an unreachable document; normal Document search methods are unaffected.
GHSA-phwj-rprq-35pp	LOW	[nokogiri] Use-after-free vulnerability in XML attribute value replacement that could cause a segfault when accessing previously-wrapped attribute child nodes. Requires unusual API usage pattern combining direct child node access with subsequent attribute value mutation.
GHSA-wjv4-x9w8-wm3h	LOW	[nokogiri] A heap use-after-free vulnerability exists when setting a non-element node (like a DTD) as the document root via Document#root=, potentially causing segfaults or invalid memory reads. The vulnerability requires programming error and cannot be triggered by untrusted input.
AIKIDO-2026-622262	LOW	[loofah] HTML5 sanitizer fails to restrict the href attribute on SVG elements, allowing Cross-site Scripting (XSS) attacks through external document references in elements like <use> and <feImage>. This enables arbitrary script execution or external content loading when sanitizing user-supplied SVG.
AIKIDO-2026-349881	LOW	[loofah] A Cross-site Scripting (XSS) vulnerability exists due to improper validation of URIs with numeric character references lacking trailing semicolons, allowing malicious scripts like javascript&#58alert(1) to bypass filtering and execute in browsers.
AIKIDO-2026-11126	LOW	[sqlite3] A use-after-free vulnerability in aggregate function callbacks allows stepping prepared statements after database closure to trigger invalid memory reads and segmentation faults, causing denial of service in applications using custom aggregates.
AIKIDO-2026-11127	LOW	[sqlite3] User-defined SQLite functions with duplicate names and different argument counts can cause invalid memory reads and process crashes due to premature garbage collection of referenced Ruby blocks. This denial-of-service vulnerability affects applications using create_function or define_function.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-17247

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #334