{"action":"Upgrade message_bus to 3.3.7 or later.","affected":[{"fixed":"3.3.7","introduced":"0"}],"component":"message_bus","cve_ids":["CVE-2021-43840"],"ecosystem":"RubyGems","epss":0.01947,"exploited":false,"fixed_versions":["3.3.7"],"ghsa_id":"GHSA-xmgj-5fh3-xjmm","id":"tcs_01M5KEPA528NSDGV6ZRB7400M1","modified_at":"2026-07-08T06:29:06.303929406Z","published_at":"2021-12-17T19:59:13Z","references":["https://osv.dev/vulnerability/GHSA-xmgj-5fh3-xjmm","https://github.com/discourse/message_bus/security/advisories/GHSA-xmgj-5fh3-xjmm","https://nvd.nist.gov/vuln/detail/CVE-2021-43840","https://github.com/discourse/message_bus/commit/9b6deee01ed474c7e9b5ff65a06bb0447b4db2ba","https://github.com/discourse/message_bus","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/message_bus/CVE-2021-43840.yml"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-xmgj-5fh3-xjmm","url":"https://osv.dev/vulnerability/GHSA-xmgj-5fh3-xjmm"}],"summary":"Path traversal when MessageBus::Diagnostics is enabled"}