{"action":"Upgrade bundler to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"1.0.0"}],"component":"bundler","cve_ids":["CVE-2016-7954"],"ecosystem":"RubyGems","epss":0.08821,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-jvgm-pfqv-887x","id":"tcs_01M5KEM12XRNBGWRAB9T6AKRQR","modified_at":"2025-04-14T22:27:57.972251Z","published_at":"2022-05-14T00:57:16Z","references":["https://osv.dev/vulnerability/GHSA-jvgm-pfqv-887x","https://nvd.nist.gov/vuln/detail/CVE-2016-7954","https://github.com/bundler/bundler/issues/5051","https://github.com/bundler/bundler/issues/5062","https://bugzilla.redhat.com/show_bug.cgi?id=1381951","https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability","https://github.com/rubygems/bundler","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2016-7954.yml","https://web.archive.org/web/20170214030311/http://www.securityfocus.com/bid/93423","http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability","http://www.openwall.com/lists/oss-security/2016/10/04/5","http://www.openwall.com/lists/oss-security/2016/10/04/7","http://www.openwall.com/lists/oss-security/2016/10/05/3"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-jvgm-pfqv-887x","url":"https://osv.dev/vulnerability/GHSA-jvgm-pfqv-887x"}],"summary":"Bundler allows attacker to inject arbitrary code via secondary Gem source"}