RubyGems/bundler CVE-2021-43809: medium 6.7, EPSS 2.91%

Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.

Action: Upgrade bundler to 2.2.33 or later.

bundle update bundler

Affected

Fixed versions

Sources

• osv: GHSA-fj7f-vq84-fh43
• https://github.com/rubygems/rubygems/security/advisories/GHSA-fj7f-vq84-fh43
• https://nvd.nist.gov/vuln/detail/CVE-2021-43809
• https://github.com/rubygems/rubygems/pull/5142
• https://github.com/rubygems/rubygems/commit/0fad1ccfe9dd7a3c5b82c1496df3c2b4842870d3
• https://github.com/rubygems/rubygems/commit/a4f2f8ac17e6ce81c689527a8b6f14381060d95f
• https://github.com/rubygems/rubygems
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2021-43809.yml
• https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
• https://www.sonarsource.com/blog/securing-developer-tools-package-managers

CVE-2021-43809 · published 2021-12-08T19:51:36Z · modified 2026-07-08T06:28:08.542099004Z · JSON