Bundler
1 CVEs tracked since 2016. Since Dec 2016, none of them reached CISA KEV.
Bundler CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2016-12 | 1 | 0 |
Products
The products that kept showing up in Bundler's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 5 most recently published vulnerabilities affecting Bundler.
- CVE-2021-43809Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile6.7
- CVE-2020-36327Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be ch...8.8
- CVE-2019-3881Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler...7.8
- CVE-2016-7954Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.9.8
- CVE-2013-0334Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.5.0
The record
- Peak rank
- #76 in Dec 2016
- Busiest month shown
- Dec 2016, 1 CVEs
- Months with a KEV entry
- 0 since Dec 2016
- Monthly snapshots
- 1 since 2016