CVE-2020-36327

HighCVSS 8.8

Published: 29/04/2021(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.31%

93th percentile - higher than 93% of all known CVEs

Summary

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, meaning a rogue gem from a public source may be chosen even if the intended choice was a private gem.

Risk Assessment

May lead to a Dependency Confusion attack where a malicious package is installed, potentially resulting in code execution in the build environment.

Recommendation

Upgrade Bundler to a version later than 2.2.16 that fixes this vulnerability, and pin dependencies to trusted sources.

Other vulnerabilities in Bundler

CVE-2016-7954Critical
Bundler 1.x may allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.

Original NVD description (English source)

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS