GHSA-g98m-96g9-wfjq CVE-2019-3881
Insecure path handling in Bundler
- Severity
- 7.0 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.53%
- Chance of exploitation in the next 30 days. Higher than 44.77% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-427 Uncontrolled Search Path Element
- CWE-552 Files or Directories Accessible to External Parties
- Fix
2.1.0- Upgrade bundler to this version or later
Description
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| bundler | >= 1.14.0, < 2.1.0 |
2.1.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
bundler RubyGems → 2.1.0
- bundler
bundle update bundler # Gemfile: gem "bundler", ">= 2.1.0"
Severity breakdown
CVSS 3.1 7.0
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
How to prevent it
- Architecture and Design, Implementation: Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
- Implementation: When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
- Implementation: Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
- Implementation: Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
- Implementation: Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
How to prevent it
- Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jvgm-pfqv-887x Bundler allows attacker to inject arbitrary code via secondary Gem source | Critical | Also affects bundler |
| GHSA-49jx-9cmc-xjxm Bundler may install gems from a different source than expected | Medium | Also affects bundler |
| GHSA-fj7f-vq84-fh43 Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile. | Medium | Also affects bundler |
| GHSA-fp4w-jxhp-m23p Dependency Confusion in Bundler | High | Also affects bundler |
| CVE-2026-110936 A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). | High Known exploited | Same weakness, CWE-427 |
| GHSA-239g-whfq-7xj9 GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution | High | Same weakness, CWE-427 |
| GHSA-6hwm-xvph-95vm NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary | High | Same weakness, CWE-427 |
| GHSA-m6wp-h223-4c8g PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification | High | Same weakness, CWE-427 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor