bundler (RubyGems)
Advisories
6
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.2.33 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update bundler # Gemfile: gem "bundler", ">= 2.2.33"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-jvgm-pfqv-887x Bundler allows attacker to inject arbitrary code via secondary Gem source |
Critical EPSS 8.82% |
>= 1.0.0, < 2.0.0 | 2.0.0 |
| GHSA-49jx-9cmc-xjxm Bundler may install gems from a different source than expected |
Medium EPSS 4.30% |
< 1.7.0 | 1.7.0 |
| GHSA-fj7f-vq84-fh43 Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile. |
Medium EPSS 2.91% |
< 2.2.33 | 2.2.33 |
| GHSA-fp4w-jxhp-m23p Dependency Confusion in Bundler |
High EPSS 6.31% |
>= 1.16.0, < 2.2.10 | 2.2.10 |
| GHSA-fp4w-jxhp-m23p Dependency Confusion in Bundler |
High EPSS 6.31% |
>= 2.2.11, < 2.2.18 | 2.2.18 |
| GHSA-g98m-96g9-wfjq Insecure path handling in Bundler |
High EPSS 0.53% |
>= 1.14.0, < 2.1.0 | 2.1.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor