{"affected":[{"product":"rubygems","source":"CNA: GitHub_M","vendor":"rubygems","versions":[{"status":"affected","version":"< 2.2.33"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"bundler","product":"bundler","source":"OSV GHSA-fj7f-vq84-fh43","vendor":"","versions":[{"status":"affected","version":"0.3.0","versionType":"RubyGems"},{"status":"affected","version":"0.3.1","versionType":"RubyGems"},{"status":"affected","version":"0.4.0","versionType":"RubyGems"},{"status":"affected","version":"0.4.1","versionType":"RubyGems"},{"status":"affected","version":"0.5.0","versionType":"RubyGems"},{"status":"affected","version":"0.6.0","versionType":"RubyGems"},{"status":"affected","version":"0.7.0","versionType":"RubyGems"},{"status":"affected","version":"0.7.1","versionType":"RubyGems"},{"status":"affected","version":"0.7.2","versionType":"RubyGems"},{"status":"affected","version":"0.7.3.pre","versionType":"RubyGems"},{"status":"affected","version":"0.7.3.pre2","versionType":"RubyGems"},{"status":"affected","version":"0.8.0","versionType":"RubyGems"},{"status":"affected","version":"0.8.1","versionType":"RubyGems"},{"status":"affected","version":"0.9.0","versionType":"RubyGems"},{"status":"affected","version":"0.9.0.pre1","versionType":"RubyGems"},{"status":"affected","version":"0.9.0.pre2","versionType":"RubyGems"},{"status":"affected","version":"0.9.0.pre3","versionType":"RubyGems"},{"status":"affected","version":"0.9.0.pre4","versionType":"RubyGems"},{"status":"affected","version":"0.9.0.pre5","versionType":"RubyGems"},{"status":"affected","version":"0.9.1","versionType":"RubyGems"},{"status":"affected","version":"0.9.1.pre1","versionType":"RubyGems"},{"status":"affected","version":"0.9.10","versionType":"RubyGems"},{"status":"affected","version":"0.9.11","versionType":"RubyGems"},{"status":"affected","version":"0.9.12","versionType":"RubyGems"},{"status":"affected","version":"0.9.13","versionType":"RubyGems"},{"status":"affected","version":"0.9.14","versionType":"RubyGems"},{"status":"affected","version":"0.9.15","versionType":"RubyGems"},{"status":"affected","version":"0.9.16","versionType":"RubyGems"},{"status":"affected","version":"0.9.17","versionType":"RubyGems"},{"status":"affected","version":"0.9.18","versionType":"RubyGems"},{"status":"affected","version":"0.9.19","versionType":"RubyGems"},{"status":"affected","version":"0.9.2","versionType":"RubyGems"},{"status":"affected","version":"0.9.20","versionType":"RubyGems"},{"status":"affected","version":"0.9.21","versionType":"RubyGems"},{"status":"affected","version":"0.9.22","versionType":"RubyGems"},{"status":"affected","version":"0.9.23","versionType":"RubyGems"},{"status":"affected","version":"0.9.24","versionType":"RubyGems"},{"status":"affected","version":"0.9.25","versionType":"RubyGems"},{"status":"affected","version":"0.9.26","versionType":"RubyGems"},{"status":"affected","version":"0.9.3","versionType":"RubyGems"},{"status":"affected","version":"0.9.4","versionType":"RubyGems"},{"status":"affected","version":"0.9.5","versionType":"RubyGems"},{"status":"affected","version":"0.9.6","versionType":"RubyGems"},{"status":"affected","version":"0.9.7","versionType":"RubyGems"},{"status":"affected","version":"0.9.8","versionType":"RubyGems"},{"status":"affected","version":"0.9.9","versionType":"RubyGems"},{"status":"affected","version":"1.0.0","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.beta.1","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.beta.10","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.beta.2","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.beta.3","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.beta.4","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.beta.5","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.beta.8","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.beta.9","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.rc.1","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.rc.2","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.rc.3","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.rc.5","versionType":"RubyGems"},{"status":"affected","version":"1.0.0.rc.6","versionType":"RubyGems"},{"status":"affected","version":"1.0.10","versionType":"RubyGems"},{"status":"affected","version":"1.0.11","versionType":"RubyGems"},{"status":"affected","version":"1.0.12","versionType":"RubyGems"},{"status":"affected","version":"1.0.13","versionType":"RubyGems"},{"status":"affected","version":"1.0.14","versionType":"RubyGems"},{"status":"affected","version":"1.0.15","versionType":"RubyGems"},{"status":"affected","version":"1.0.17","versionType":"RubyGems"},{"status":"affected","version":"1.0.18","versionType":"RubyGems"},{"status":"affected","version":"1.0.19.rc","versionType":"RubyGems"},{"status":"affected","version":"1.0.2","versionType":"RubyGems"},{"status":"affected","version":"1.0.20","versionType":"RubyGems"},{"status":"affected","version":"1.0.20.rc","versionType":"RubyGems"},{"status":"affected","version":"1.0.21","versionType":"RubyGems"},{"status":"affected","version":"1.0.21.rc","versionType":"RubyGems"},{"status":"affected","version":"1.0.22","versionType":"RubyGems"},{"status":"affected","version":"1.0.3","versionType":"RubyGems"},{"status":"affected","version":"1.0.5","versionType":"RubyGems"},{"status":"affected","version":"1.0.7","versionType":"RubyGems"},{"status":"affected","version":"1.0.9","versionType":"RubyGems"},{"status":"affected","version":"1.1.0","versionType":"RubyGems"},{"status":"affected","version":"1.1.1","versionType":"RubyGems"},{"status":"affected","version":"1.1.2","versionType":"RubyGems"},{"status":"affected","version":"1.1.3","versionType":"RubyGems"},{"status":"affected","version":"1.1.4","versionType":"RubyGems"},{"status":"affected","version":"1.1.5","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.10","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.3","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.4","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.5","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.7","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.8","versionType":"RubyGems"},{"status":"affected","version":"1.1.pre.9","versionType":"RubyGems"},{"status":"affected","version":"1.1.rc","versionType":"RubyGems"},{"status":"affected","version":"1.1.rc.2","versionType":"RubyGems"},{"status":"affected","version":"1.1.rc.3","versionType":"RubyGems"},{"status":"affected","version":"1.1.rc.5","versionType":"RubyGems"},{"status":"affected","version":"1.1.rc.6","versionType":"RubyGems"},{"status":"affected","version":"1.1.rc.7","versionType":"RubyGems"},{"status":"affected","version":"1.1.rc.8","versionType":"RubyGems"},{"status":"affected","version":"1.10.0","versionType":"RubyGems"},{"status":"affected","version":"1.10.0.pre","versionType":"RubyGems"},{"status":"affected","version":"1.10.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.10.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.10.0.rc","versionType":"RubyGems"},{"status":"affected","version":"1.10.1","versionType":"RubyGems"},{"status":"affected","version":"1.10.2","versionType":"RubyGems"},{"status":"affected","version":"1.10.3","versionType":"RubyGems"},{"status":"affected","version":"1.10.4","versionType":"RubyGems"},{"status":"affected","version":"1.10.5","versionType":"RubyGems"},{"status":"affected","version":"1.10.6","versionType":"RubyGems"},{"status":"affected","version":"1.11.0","versionType":"RubyGems"},{"status":"affected","version":"1.11.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.11.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.11.1","versionType":"RubyGems"},{"status":"affected","version":"1.11.2","versionType":"RubyGems"},{"status":"affected","version":"1.12.0","versionType":"RubyGems"},{"status":"affected","version":"1.12.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.12.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.12.0.rc","versionType":"RubyGems"},{"status":"affected","version":"1.12.0.rc.2","versionType":"RubyGems"},{"status":"affected","version":"1.12.0.rc.3","versionType":"RubyGems"},{"status":"affected","version":"1.12.0.rc.4","versionType":"RubyGems"},{"status":"affected","version":"1.12.1","versionType":"RubyGems"},{"status":"affected","version":"1.12.2","versionType":"RubyGems"},{"status":"affected","version":"1.12.3","versionType":"RubyGems"},{"status":"affected","version":"1.12.4","versionType":"RubyGems"},{"status":"affected","version":"1.12.5","versionType":"RubyGems"},{"status":"affected","version":"1.12.6","versionType":"RubyGems"},{"status":"affected","version":"1.13.0","versionType":"RubyGems"},{"status":"affected","version":"1.13.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.13.0.rc.1","versionType":"RubyGems"},{"status":"affected","version":"1.13.0.rc.2","versionType":"RubyGems"},{"status":"affected","version":"1.13.1","versionType":"RubyGems"},{"status":"affected","version":"1.13.2","versionType":"RubyGems"},{"status":"affected","version":"1.13.3","versionType":"RubyGems"},{"status":"affected","version":"1.13.4","versionType":"RubyGems"},{"status":"affected","version":"1.13.5","versionType":"RubyGems"},{"status":"affected","version":"1.13.6","versionType":"RubyGems"},{"status":"affected","version":"1.13.7","versionType":"RubyGems"},{"status":"affected","version":"1.14.0","versionType":"RubyGems"},{"status":"affected","version":"1.14.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.14.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.14.1","versionType":"RubyGems"},{"status":"affected","version":"1.14.2","versionType":"RubyGems"},{"status":"affected","version":"1.14.3","versionType":"RubyGems"},{"status":"affected","version":"1.14.4","versionType":"RubyGems"},{"status":"affected","version":"1.14.5","versionType":"RubyGems"},{"status":"affected","version":"1.14.6","versionType":"RubyGems"},{"status":"affected","version":"1.15.0","versionType":"RubyGems"},{"status":"affected","version":"1.15.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.15.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.15.0.pre.3","versionType":"RubyGems"},{"status":"affected","version":"1.15.0.pre.4","versionType":"RubyGems"},{"status":"affected","version":"1.15.1","versionType":"RubyGems"},{"status":"affected","version":"1.15.2","versionType":"RubyGems"},{"status":"affected","version":"1.15.3","versionType":"RubyGems"},{"status":"affected","version":"1.15.4","versionType":"RubyGems"},{"status":"affected","version":"1.16.0","versionType":"RubyGems"},{"status":"affected","version":"1.16.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.16.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.16.0.pre.3","versionType":"RubyGems"},{"status":"affected","version":"1.16.1","versionType":"RubyGems"},{"status":"affected","version":"1.16.2","versionType":"RubyGems"},{"status":"affected","version":"1.16.3","versionType":"RubyGems"},{"status":"affected","version":"1.16.4","versionType":"RubyGems"},{"status":"affected","version":"1.16.5","versionType":"RubyGems"},{"status":"affected","version":"1.16.6","versionType":"RubyGems"},{"status":"affected","version":"1.17.0","versionType":"RubyGems"},{"status":"affected","version":"1.17.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.17.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.17.1","versionType":"RubyGems"},{"status":"affected","version":"1.17.2","versionType":"RubyGems"},{"status":"affected","version":"1.17.3","versionType":"RubyGems"},{"status":"affected","version":"1.2.0","versionType":"RubyGems"},{"status":"affected","version":"1.2.0.pre","versionType":"RubyGems"},{"status":"affected","version":"1.2.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.2.0.rc","versionType":"RubyGems"},{"status":"affected","version":"1.2.0.rc.2","versionType":"RubyGems"},{"status":"affected","version":"1.2.1","versionType":"RubyGems"},{"status":"affected","version":"1.2.2","versionType":"RubyGems"},{"status":"affected","version":"1.2.3","versionType":"RubyGems"},{"status":"affected","version":"1.2.4","versionType":"RubyGems"},{"status":"affected","version":"1.2.5","versionType":"RubyGems"},{"status":"affected","version":"1.3.0","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.pre","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.pre.3","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.pre.4","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.pre.5","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.pre.6","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.pre.7","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.pre.8","versionType":"RubyGems"},{"status":"affected","version":"1.3.1","versionType":"RubyGems"},{"status":"affected","version":"1.3.2","versionType":"RubyGems"},{"status":"affected","version":"1.3.3","versionType":"RubyGems"},{"status":"affected","version":"1.3.4","versionType":"RubyGems"},{"status":"affected","version":"1.3.5","versionType":"RubyGems"},{"status":"affected","version":"1.3.6","versionType":"RubyGems"},{"status":"affected","version":"1.4.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.4.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.4.0.rc.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.0","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.rc.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.rc.2","versionType":"RubyGems"},{"status":"affected","version":"1.5.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.2","versionType":"RubyGems"},{"status":"affected","version":"1.5.3","versionType":"RubyGems"},{"status":"affected","version":"1.6.0","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.rc","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.6.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.2","versionType":"RubyGems"},{"status":"affected","version":"1.6.3","versionType":"RubyGems"},{"status":"affected","version":"1.6.4","versionType":"RubyGems"},{"status":"affected","version":"1.6.5","versionType":"RubyGems"},{"status":"affected","version":"1.6.6","versionType":"RubyGems"},{"status":"affected","version":"1.6.7","versionType":"RubyGems"},{"status":"affected","version":"1.6.8","versionType":"RubyGems"},{"status":"affected","version":"1.6.9","versionType":"RubyGems"},{"status":"affected","version":"1.7.0","versionType":"RubyGems"},{"status":"affected","version":"1.7.1","versionType":"RubyGems"},{"status":"affected","version":"1.7.1.pre","versionType":"RubyGems"},{"status":"affected","version":"1.7.1.pre.2","versionType":"RubyGems"},{"status":"affected","version":"1.7.1.pre.3","versionType":"RubyGems"},{"status":"affected","version":"1.7.10","versionType":"RubyGems"},{"status":"affected","version":"1.7.11","versionType":"RubyGems"},{"status":"affected","version":"1.7.12","versionType":"RubyGems"},{"status":"affected","version":"1.7.13","versionType":"RubyGems"},{"status":"affected","version":"1.7.14","versionType":"RubyGems"},{"status":"affected","version":"1.7.15","versionType":"RubyGems"},{"status":"affected","version":"1.7.2","versionType":"RubyGems"},{"status":"affected","version":"1.7.3","versionType":"RubyGems"},{"status":"affected","version":"1.7.4","versionType":"RubyGems"},{"status":"affected","version":"1.7.5","versionType":"RubyGems"},{"status":"affected","version":"1.7.6","versionType":"RubyGems"},{"status":"affected","version":"1.7.7","versionType":"RubyGems"},{"status":"affected","version":"1.7.8","versionType":"RubyGems"},{"status":"affected","version":"1.7.9","versionType":"RubyGems"},{"status":"affected","version":"1.8.0","versionType":"RubyGems"},{"status":"affected","version":"1.8.0.pre","versionType":"RubyGems"},{"status":"affected","version":"1.8.1","versionType":"RubyGems"},{"status":"affected","version":"1.8.2","versionType":"RubyGems"},{"status":"affected","version":"1.8.3","versionType":"RubyGems"},{"status":"affected","version":"1.8.4","versionType":"RubyGems"},{"status":"affected","version":"1.8.5","versionType":"RubyGems"},{"status":"affected","version":"1.8.6","versionType":"RubyGems"},{"status":"affected","version":"1.8.7","versionType":"RubyGems"},{"status":"affected","version":"1.8.8","versionType":"RubyGems"},{"status":"affected","version":"1.8.9","versionType":"RubyGems"},{"status":"affected","version":"1.9.0","versionType":"RubyGems"},{"status":"affected","version":"1.9.0.pre","versionType":"RubyGems"},{"status":"affected","version":"1.9.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"1.9.0.rc","versionType":"RubyGems"},{"status":"affected","version":"1.9.1","versionType":"RubyGems"},{"status":"affected","version":"1.9.10","versionType":"RubyGems"},{"status":"affected","version":"1.9.2","versionType":"RubyGems"},{"status":"affected","version":"1.9.3","versionType":"RubyGems"},{"status":"affected","version":"1.9.4","versionType":"RubyGems"},{"status":"affected","version":"1.9.5","versionType":"RubyGems"},{"status":"affected","version":"1.9.6","versionType":"RubyGems"},{"status":"affected","version":"1.9.7","versionType":"RubyGems"},{"status":"affected","version":"1.9.8","versionType":"RubyGems"},{"status":"affected","version":"1.9.9","versionType":"RubyGems"},{"status":"affected","version":"2.0.0","versionType":"RubyGems"},{"status":"affected","version":"2.0.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"2.0.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"2.0.0.pre.3","versionType":"RubyGems"},{"status":"affected","version":"2.0.1","versionType":"RubyGems"},{"status":"affected","version":"2.0.2","versionType":"RubyGems"},{"status":"affected","version":"2.1.0","versionType":"RubyGems"},{"status":"affected","version":"2.1.0.pre.1","versionType":"RubyGems"},{"status":"affected","version":"2.1.0.pre.2","versionType":"RubyGems"},{"status":"affected","version":"2.1.0.pre.3","versionType":"RubyGems"},{"status":"affected","version":"2.1.1","versionType":"RubyGems"},{"status":"affected","version":"2.1.2","versionType":"RubyGems"},{"status":"affected","version":"2.1.3","versionType":"RubyGems"},{"status":"affected","version":"2.1.4","versionType":"RubyGems"},{"status":"affected","version":"2.2.0","versionType":"RubyGems"},{"status":"affected","version":"2.2.0.rc.1","versionType":"RubyGems"},{"status":"affected","version":"2.2.0.rc.2","versionType":"RubyGems"},{"status":"affected","version":"2.2.1","versionType":"RubyGems"},{"status":"affected","version":"2.2.10","versionType":"RubyGems"},{"status":"affected","version":"2.2.11","versionType":"RubyGems"},{"status":"affected","version":"2.2.12","versionType":"RubyGems"},{"status":"affected","version":"2.2.13","versionType":"RubyGems"},{"status":"affected","version":"2.2.14","versionType":"RubyGems"},{"status":"affected","version":"2.2.15","versionType":"RubyGems"},{"status":"affected","version":"2.2.16","versionType":"RubyGems"},{"status":"affected","version":"2.2.17","versionType":"RubyGems"},{"status":"affected","version":"2.2.18","versionType":"RubyGems"},{"status":"affected","version":"2.2.19","versionType":"RubyGems"},{"status":"affected","version":"2.2.2","versionType":"RubyGems"},{"status":"affected","version":"2.2.20","versionType":"RubyGems"},{"status":"affected","version":"2.2.21","versionType":"RubyGems"},{"status":"affected","version":"2.2.22","versionType":"RubyGems"},{"status":"affected","version":"2.2.23","versionType":"RubyGems"},{"status":"affected","version":"2.2.24","versionType":"RubyGems"},{"status":"affected","version":"2.2.25","versionType":"RubyGems"},{"status":"affected","version":"2.2.26","versionType":"RubyGems"},{"status":"affected","version":"2.2.27","versionType":"RubyGems"},{"status":"affected","version":"2.2.28","versionType":"RubyGems"},{"status":"affected","version":"2.2.29","versionType":"RubyGems"},{"status":"affected","version":"2.2.3","versionType":"RubyGems"},{"status":"affected","version":"2.2.30","versionType":"RubyGems"},{"status":"affected","version":"2.2.31","versionType":"RubyGems"},{"status":"affected","version":"2.2.32","versionType":"RubyGems"},{"status":"affected","version":"2.2.4","versionType":"RubyGems"},{"status":"affected","version":"2.2.5","versionType":"RubyGems"},{"status":"affected","version":"2.2.6","versionType":"RubyGems"},{"status":"affected","version":"2.2.7","versionType":"RubyGems"},{"status":"affected","version":"2.2.8","versionType":"RubyGems"},{"status":"affected","version":"2.2.9","versionType":"RubyGems"},{"events":[{"introduced":"0"},{"fixed":"2.2.33"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2021-43809","cwes":["CWE-88"],"description":"`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the `Gemfile` file, it can contain any character, including a leading dash.\n\nTo exploit this vulnerability, an attacker has to craft a directory containing a `Gemfile` file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of `-u./payload`. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as `bundle lock`, inside.\n\nThis vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, the exploitability is very low, because it requires a lot of user interaction. Bundler 2.2.33 has patched this problem by inserting `--` as an argument before any positional arguments to those Git commands that were affected by this issue. Regardless of whether users can upgrade or not, they should review any untrustred `Gemfile`'s before running any `bundler` commands that may read them, since they can contain arbitrary ruby code.","epss":{"date":"2026-11-02","percentile":0.86987,"score":0.02909},"exploits":[],"kev":null,"metrics":[{"score":6.7,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793643255426,"publishedAt":1638989412000,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/rubygems/rubygems/security/advisories/GHSA-fj7f-vq84-fh43"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rubygems/rubygems/pull/5142"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rubygems/rubygems/commit/0fad1ccfe9dd7a3c5b82c1496df3c2b4842870d3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rubygems/rubygems/commit/a4f2f8ac17e6ce81c689527a8b6f14381060d95f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://www.sonarsource.com/blog/securing-developer-tools-package-managers/"},{"source":"ADP: CVE","tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/rubygems/rubygems/security/advisories/GHSA-fj7f-vq84-fh43"},{"source":"ADP: CVE","tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/rubygems/rubygems/pull/5142"},{"source":"ADP: CVE","tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/rubygems/rubygems/commit/0fad1ccfe9dd7a3c5b82c1496df3c2b4842870d3"},{"source":"ADP: CVE","tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/rubygems/rubygems/commit/a4f2f8ac17e6ce81c689527a8b6f14381060d95f"},{"source":"ADP: CVE","tags":["x_refsource_MISC","x_transferred"],"url":"https://www.sonarsource.com/blog/securing-developer-tools-package-managers/"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-fj7f-vq84-fh43"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-fj7f-vq84-fh43"}],"remediation":[{"kind":"fix","source":"OSV GHSA-fj7f-vq84-fh43","text":"bundler (RubyGems): OSV reports a fixed version 2.2.33. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-fj7f-vq84-fh43"}],"revision":"a300c3e484dbbe48edd5c048176f28d916a6900ca07e50d74ee87c1dd333bc9f","sources":[{"modifiedAt":1793643255426,"name":"CNA: GitHub_M","retrievedAt":1793646504778,"url":"https://www.cve.org/CVERecord?id=CVE-2021-43809"},{"modifiedAt":1783492088542,"name":"OSV / GitHub Security Advisories","retrievedAt":1793646505519,"url":"https://osv.dev/vulnerability/GHSA-fj7f-vq84-fh43"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793646508113,"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-43809"}],"ssvc":{"assessedAt":1793643244647,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile","updatedAt":1793646508113}