Rubygems vulnerabilities
We track 5 vulnerabilities in Rubygems products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on January 12, 2024.
Latest Rubygems vulnerabilities
- 9.8 Critical severity
rubygems.org: Improper Authentication
Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to by
- 7.5 High severity
rubygems.org is the Ruby community's primary gem (library) hosting service.
rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching `/-\d/`, permanently replacing the
- 8.8 High severity
rubygems.org: Improper Authentication
RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable
- 7.5 High severity
rubygems.org: Incorrect Authorization
RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN
- 7.5 High severity
rubygems.org: Incorrect Authorization
Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so. To be vulnerabl