ZDF
Sign inSign up

Vulnerabilities

Security incident · CVE-2021-43809

is a package for managing application dependencies in Ruby.

Published Dec 8, 2021 · catalog updated Nov 2, 2026 · is a package for

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2021-43809. EPSS is 2.91%. Act only if a listed version of is a package for is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (is a package for).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
2.91%
Remediation
Version ranges on file
Affected products
cpe bundler/bundler

is a package for managing application dependencies in Ruby. In versions before 2.2.33, when working with untrusted and apparently harmless 's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the itself. However, if the includes entries that use the option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as . These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash ( ) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the file, it can contain any character, including a leading dash. To exploit this vulnerability, an attacker has to craft a directory containing a file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of . This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as , inside. This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, the exploitability is very low, because it requires a lot of user interaction. Bundler 2.2.33 has patched this problem by inserting as an argument before any positional arguments to those Git commands that were affected by this issue. Regardless of whether users can upgrade or

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe bundler/bundler< 2.2.33

How to fix CVE-2021-43809

  • Upgrade

    CVE-2021-43809 lists a fix boundary at 2.2.33. Compare the installed build with that boundary before you change production.

  • Version check

    Affected < 2.2.33

  • Advisory

    Open the cve_org record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2021-43809. EPSS is 2.91%. Act only if a listed version of is a package for is installed.

Which versions are affected?

Compare what you have installed with < 2.2.33. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-88. EPSS 2.91%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 8, 2021 · NIST NVD

    Detected

    is a package for managing application dependencies in Ruby. In versions before 2.2.33, when working with untrusted and apparently harmless 's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the itself. However, if the includes entries that use the option with invalid, but seemingly harmless, values with a leading dash, this can be fa

  2. Nov 2, 2026 · NIST NVD

    Updated

    is a package for managing application dependencies in Ruby. In versions before 2.2.33, when working with untrusted and apparently harmless 's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the itself. However, if the includes entries that use the option with invalid, but seemingly harmless, values with a leading dash, this can be fa

Sources

  • CVE.orgVulnerability recordCVE-2021-43809

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2021-43809

    is a package for managing application dependencies in Ruby. In versions before 2.2.33, when working with untrusted and apparently harmless 's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code ins

    nvd.nist.gov

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • CVE.orgNov 4, 2026
  • NIST NVDNov 3, 2026