4 known security vulnerabilities

  • criticalGHSA-jvgm-pfqv-887x(CVE-2016-7954)

    Bundler allows attacker to inject arbitrary code via secondary Gem source

Show 3 more vulnerabilities
2 high1 moderate
  • highGHSA-fp4w-jxhp-m23p(CVE-2020-36327)

    Dependency Confusion in Bundler

  • highGHSA-g98m-96g9-wfjq(CVE-2019-3881)

    Insecure path handling in Bundler

  • moderateGHSA-fj7f-vq84-fh43(CVE-2021-43809)

    Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.

Bundler manages an application's dependencies through its entire life, across many machines, systematically and repeatably

Required Ruby Version

>= 1.8.7

Required Rubygems Version

>= 1.3.6

Authors

André Arko, Samuel Giddins, Colby Swandale, Hiroshi Shibata, David Rodríguez, Grey Baker, Stephanie Morillo, Chris Morris, James Wen, Tim Moore, André Medeiros, Jessica Lynn Suttles, Terence Lee, Carl Lerche, Yehuda Katz

Versions

  1. 4.1.0.beta2

    1. source

      1. 4.1.0.beta2 source October 08, 2026 (402 KB)
  2. 4.1.0.beta1

    1. source

      1. 4.1.0.beta1 source September 09, 2026 (397 KB)
  3. 4.0.23

    1. source

      1. 4.0.23 source October 14, 2026 (460 KB)
  4. 4.0.22

    1. source

      1. 4.0.22 source September 30, 2026 (458 KB)
  5. 4.0.21

    1. source

      1. 4.0.21 source September 16, 2026 (458 KB)
  6. 1.17.3

    1. source

      1. 1.17.3 source December 27, 2018 (356 KB)
Show all versions (445 total)

SHA 256 checksum

← Previous version Next version →