Bundler is a widely embedded dependency-management tool for Ruby applications that, despite its singular product scope, holds a critical position in the Ruby development and deployment supply chain. Its durable vulnerability signal centers on code-injection and argument-injection weaknesses alongside improper input validation, reflecting the parsing and command-execution patterns inherent to a package resolver. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Bundler over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-7954CRITICAL Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2 | Dec 22, 2016 | 9.8 | 33 | NO | NO |
CVE-2020-36327HIGH Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public | Apr 29, 2021 | 8.8 | 30 | NO | NO |
CVE-2019-3881HIGH Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not avai | Sep 4, 2020 | 7.8 | 26 | NO | NO |
CVE-2021-43809HIGH `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is no | Dec 8, 2021 | 7.3 | 25 | NO | NO |
CVE-2013-0334MEDIUM Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a differ | Oct 31, 2014 | 5.0 | 21 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Bundler.
Media articles that mention a CVE ID that affects a product developed by Bundler — matched by CVE ID, not by vendor name.