{"action":"Upgrade bundler to 2.2.33 or later.","affected":[{"fixed":"2.2.33","introduced":"0"}],"component":"bundler","cve_ids":["CVE-2021-43809"],"ecosystem":"RubyGems","epss":0.02909,"exploited":false,"fixed_versions":["2.2.33"],"ghsa_id":"GHSA-fj7f-vq84-fh43","id":"tcs_01M5KEK38ZH5QMJCCVX9AYK29R","modified_at":"2026-07-08T06:28:08.542099004Z","published_at":"2021-12-08T19:51:36Z","references":["https://osv.dev/vulnerability/GHSA-fj7f-vq84-fh43","https://github.com/rubygems/rubygems/security/advisories/GHSA-fj7f-vq84-fh43","https://nvd.nist.gov/vuln/detail/CVE-2021-43809","https://github.com/rubygems/rubygems/pull/5142","https://github.com/rubygems/rubygems/commit/0fad1ccfe9dd7a3c5b82c1496df3c2b4842870d3","https://github.com/rubygems/rubygems/commit/a4f2f8ac17e6ce81c689527a8b6f14381060d95f","https://github.com/rubygems/rubygems","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2021-43809.yml","https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html","https://www.sonarsource.com/blog/securing-developer-tools-package-managers"],"severity":{"label":"medium","score":6.7},"sources":[{"source":"osv","source_id":"GHSA-fj7f-vq84-fh43","url":"https://osv.dev/vulnerability/GHSA-fj7f-vq84-fh43"}],"summary":"Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile."}