PT-2021-5751 · Bundler+6 · Bundler+6

Paul-Gerste-Sonarsource

·

Published

2021-12-08

·

Updated

2026-05-04

·

CVE-2021-43809

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions bundler versions prior to 2.2.33
Description The issue is related to the handling of untrusted Gemfile's in bundler. When a Gemfile includes gem entries with the git option and invalid values starting with a dash, it can lead to Code Execution. This happens because bundler uses commands like git clone and constructs them using user input, which can be interpreted as optional arguments instead of positional ones. An attacker can exploit this by crafting a directory with a Gemfile that declares a dependency in a Git repository with a Git URL in the form of -u./payload. This can lead to Arbitrary Code Execution, potentially allowing the takeover of the system. However, the exploitability is low due to the requirement of significant user interaction.
Recommendations To resolve the issue, update to bundler version 2.2.33 or later. For versions prior to 2.2.33, as a temporary workaround, consider reviewing any untrusted Gemfile's before running any bundler commands that may read them, since they can contain arbitrary ruby code.

Exploit

Fix

Argument Injection

Weakness Enumeration

Related Identifiers

ALSA-2025:7539
BDU:2022-00196
CESA-2025_7539
CVE-2021-43809
DLA-4163-1
GHSA-FJ7F-VQ84-FH43
INFSA-2025_7539
MGASA-2022-0102
OESA-2021-1480
OESA-2022-1934
OPENSUSE-SU-2024_3873-1
RHSA-2025:7539
RHSA-2025_7539
SUSE-SU-2024:3873-1
SUSE-SU-2024_3873-1
SUSE-SU-2026:1355-1

Affected Products

Almalinux
Centos
Debian
Red Hat
Rocky Linux
Suse
Bundler