Improper verification of signatures in tarball allows to install mis-signed gem when tarball contain multiple gem signatures.
Upstream fix:
https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693
External References:
https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
Last updated 24 July 2024
Last updated 18 August 2025
A flaw was found in RubyGems. A crafted gem with a multi-line name is not handled correctly allowing an attacker to inject arbitrary code to the stub line of gemspec. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Last updated 11 July 2025
Last updated 18 August 2025
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#withresponse may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alerterror without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
Last updated 18 August 2025
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
Last updated 18 August 2025
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
Last updated 11 July 2025
Last updated 24 July 2024
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Cross-site scripting vulnerability in homepage attribute when displayed via gem server was found.
Upstream fix:
https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb
External References:
https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
Last updated 18 August 2025
Last updated 18 August 2025