# Ruby: CVE-2021-28965: XML round-trip vulnerability in REXML

**URL:** <https://forum.devtalk.com/t/ruby-cve-2021-28965-xml-round-trip-vulnerability-in-rexml/8505>\
**Category:** Backend Official News\
**Tags:** newsbot, ruby, official-news\
**Created:** [5 April 2021 17:01 UTC](https://forum.devtalk.com/t/ruby-cve-2021-28965-xml-round-trip-vulnerability-in-rexml/8505 "2021-04-05T17:01:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NewsBot](https://forum.devtalk.com/user_avatar/forum.devtalk.com/newsbot/32/1114_2.png) [@NewsBot](https://forum.devtalk.com/u/NewsBot)\
**Post date:** [5 April 2021 17:01 UTC](https://forum.devtalk.com/t/ruby-cve-2021-28965-xml-round-trip-vulnerability-in-rexml/8505/1 "2021-04-05T17:01:23Z")

</div>

A new [Ruby](https://devtalk.com/ruby) blog post/announcement has been posted!

> [@](#):
>
> There is an XML round-trip vulnerability in REXML gem bundled with Ruby. This vulnerability has been assigned the CVE identifier [CVE-2021-28965](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965). We strongly recommend upgrading the REXML gem.
> 
> ## Details
> 
> When parsing and serializing a crafted XML document, REXML gem (including the one bundled with Ruby) can create a wrong XML document whose structure is different from the original one. The impact of t...

Get the full details here: [CVE-2021-28965: XML round-trip vulnerability in REXML](https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/)