VulnerableCode Package Details - pkg:gem/bundler@2.1.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-6t9d-2n3y-nbgv Aliases: CVE-2020-36327 GHSA-fp4w-jxhp-m23p	insufficient validation	2.2.10 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.2.16 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 2.2.18 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-hk69-vd9p-wfb3 Aliases: CVE-2021-43809 GHSA-fj7f-vq84-fh43	arbitrary command execution	2.2.33 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-6t9d-2n3y-nbgv
Aliases:
CVE-2020-36327
GHSA-fp4w-jxhp-m23p

insufficient validation

2.2.10
Affected by 2 other vulnerabilities.

2.2.16
Affected by 1 other vulnerability.

2.2.18
Affected by 1 other vulnerability.

VCID-hk69-vd9p-wfb3
Aliases:
CVE-2021-43809
GHSA-fj7f-vq84-fh43

arbitrary command execution

2.2.33
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-e1c6-7d44-gqc8	Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.	CVE-2019-3881 GHSA-g98m-96g9-wfjq

Vulnerability

Summary

Aliases

VCID-e1c6-7d44-gqc8

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

CVE-2019-3881
GHSA-g98m-96g9-wfjq

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-03T18:07:47.517354+00:00	GitLab Importer	Affected by	VCID-hk69-vd9p-wfb3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2021-43809.yml	37.0.0
2025-07-03T17:58:53.969200+00:00	GitLab Importer	Affected by	VCID-6t9d-2n3y-nbgv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2020-36327.yml	37.0.0
2025-07-03T17:50:03.457353+00:00	GitLab Importer	Fixing	VCID-e1c6-7d44-gqc8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2019-3881.yml	37.0.0
2025-07-03T16:51:30.746776+00:00	GHSA Importer	Fixing	VCID-e1c6-7d44-gqc8	https://github.com/advisories/GHSA-g98m-96g9-wfjq	37.0.0
2025-07-03T13:55:35.878884+00:00	GitLab Importer	Fixing	VCID-e1c6-7d44-gqc8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/bundler/CVE-2019-3881.yml	36.1.3
2025-07-01T12:20:13.860453+00:00	GithubOSV Importer	Fixing	VCID-e1c6-7d44-gqc8	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-g98m-96g9-wfjq/GHSA-g98m-96g9-wfjq.json	36.1.3