Nokogiri's HTML5 serializer prior to version 1.19.5 did not properly escape text inside noscript elements or angle brackets inside attribute values. This flaw could lead to mutation cross-site scripting (XSS) when sanitized HTML containing noscript elements is serialized and rendered by browsers with scripting enabled. The issue affects only the C extension versions (CRuby and TruffleRuby) and not JRuby. The vulnerability is rated low severity with a CVSS score of 2.3. The maintainers recommend upgrading to Nokogiri 1.19.5 or later and using the parse_noscript_content_as_text option or removing noscript elements as mitigation.