Bundler vulnerabilities

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, meaning a rogue gem from a public source may be chosen even if the intended choice was a private gem.

Bundler 1.x may allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.

A vulnerability in Bundler versions before 2.2.33 allows arbitrary code execution when processing untrusted Gemfile. If a Gemfile contains a git dependency with a URL starting with a dash (e.g., '-u./payload'), Bundler may interpret it as a git clone option, leading to code execution.