Search for packages
| purl | pkg:gem/bundler@1.10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-e1c6-7d44-gqc8
Aliases: CVE-2019-3881 GHSA-g98m-96g9-wfjq |
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed. |
Affected by 2 other vulnerabilities. |
|
VCID-hk69-vd9p-wfb3
Aliases: CVE-2021-43809 GHSA-fj7f-vq84-fh43 |
arbitrary command execution |
Affected by 0 other vulnerabilities. |
|
VCID-rsuu-68yw-tkbu
Aliases: CVE-2016-7954 GHSA-jvgm-pfqv-887x |
Bundler allows attacker to inject arbitrary code via secondary Gem source Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334. |
Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-07-03T18:17:43.183543+00:00 | GitLab Importer | Affected by | VCID-rsuu-68yw-tkbu | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2016-7954.yml | 37.0.0 |
| 2025-07-03T18:07:47.358062+00:00 | GitLab Importer | Affected by | VCID-hk69-vd9p-wfb3 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2021-43809.yml | 37.0.0 |
| 2025-07-03T17:50:03.310738+00:00 | GitLab Importer | Affected by | VCID-e1c6-7d44-gqc8 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2019-3881.yml | 37.0.0 |