CVE-2016-7954

Critical

Published: 22/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Bundler 1.x may allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.

Risk Assessment

Attackers could exploit this vulnerability to gain control over the application, potentially leading to serious security implications for the organization.

Recommendation

It is recommended to update Bundler to the latest version and monitor the gems in use to avoid name collisions.

Original NVD description (English source)

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.