VulnerableCode Package Details - pkg:gem/bundler@1.16.0

Search for packages

Package details: pkg:gem/bundler@1.16.0

Essentials
History (8)

purl	pkg:gem/bundler@1.16.0

Next non-vulnerable version	2.2.33
Latest non-vulnerable version	2.2.33
Risk	4.5

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-6t9d-2n3y-nbgv Aliases: CVE-2020-36327 GHSA-fp4w-jxhp-m23p	insufficient validation	2.2.10 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.2.16 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 2.2.18 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-e1c6-7d44-gqc8 Aliases: CVE-2019-3881 GHSA-g98m-96g9-wfjq	Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.	2.1.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-hk69-vd9p-wfb3 Aliases: CVE-2021-43809 GHSA-fj7f-vq84-fh43	arbitrary command execution	2.2.33 Affected by 0 other vulnerabilities.
VCID-rsuu-68yw-tkbu Aliases: CVE-2016-7954 GHSA-jvgm-pfqv-887x	Bundler allows attacker to inject arbitrary code via secondary Gem source Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.	2.0.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-03T18:17:43.282996+00:00	GitLab Importer	Affected by	VCID-rsuu-68yw-tkbu	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2016-7954.yml	37.0.0
2025-07-03T18:07:47.472799+00:00	GitLab Importer	Affected by	VCID-hk69-vd9p-wfb3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2021-43809.yml	37.0.0
2025-07-03T17:58:53.923176+00:00	GitLab Importer	Affected by	VCID-6t9d-2n3y-nbgv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2020-36327.yml	37.0.0
2025-07-03T17:50:03.415194+00:00	GitLab Importer	Affected by	VCID-e1c6-7d44-gqc8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2019-3881.yml	37.0.0
2025-07-03T17:03:01.296934+00:00	GHSA Importer	Affected by	VCID-e1c6-7d44-gqc8	https://github.com/advisories/GHSA-g98m-96g9-wfjq	37.0.0
2025-07-03T16:51:56.342705+00:00	GHSA Importer	Affected by	VCID-6t9d-2n3y-nbgv	https://github.com/advisories/GHSA-fp4w-jxhp-m23p	37.0.0
2025-07-03T13:56:15.839503+00:00	GitLab Importer	Affected by	VCID-6t9d-2n3y-nbgv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2020-36327.yml	36.1.3
2025-07-01T16:58:14.870501+00:00	Ruby Importer	Affected by	VCID-6t9d-2n3y-nbgv	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2020-36327.yml	36.1.3