# rubygems-update (RubyGems) vulnerabilities Source: https://junglewise.ai/threats/technologies/rubygems-update Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/rubygems-update.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 25 vulnerabilities in rubygems-update (RubyGems): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2012-2125, was published on 17 May 2022. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 25 (0 critical, 0 exploited in the wild) ## About rubygems-update (RubyGems) Package management tool for updating Ruby and Ruby libraries from the RubyGems repository. ## Latest rubygems-update (RubyGems) vulnerabilities - [CVE-2012-2125: RubyGems HTTPS to HTTP redirect](https://junglewise.ai/threats/cve-2012-2125-rubygems-https-to-http-redirect) (info, published 17 May 2022) - [CVE-2012-2126: RubyGems does not verify SSL certificate](https://junglewise.ai/threats/cve-2012-2126-rubygems-does-not-verify-ssl-certificate) (info, published 17 May 2022) - [CVE-2015-4020: RubyGems Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2015-4020-rubygems-improper-input-validation-vulnerability) (info, published 17 May 2022) - [CVE-2013-4363: RubyGems Regular Expression Denial of Service](https://junglewise.ai/threats/cve-2013-4363-rubygems-regular-expression-denial-of-service) (info, published 17 May 2022) - [CVE-2018-1000079: RubyGems Path Traversal vulnerability](https://junglewise.ai/threats/cve-2018-1000079-rubygems-path-traversal-vulnerability) (low, CVSS 3, published 14 May 2022) - [CVE-2015-3900: RubyGems vulnerable to DNS hijack attack](https://junglewise.ai/threats/cve-2015-3900-rubygems-vulnerable-to-dns-hijack-attack) (info, published 14 May 2022) - [CVE-2013-4287: RubyGems Regular Expression Denial of Service vulnerability](https://junglewise.ai/threats/cve-2013-4287-rubygems-regular-expression-denial-of-service-vulnerability) (info, published 14 May 2022) - [CVE-2017-0900: RubyGems Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2017-0900-rubygems-improper-input-validation-vulnerability) (low, CVSS 3, published 14 May 2022) - [CVE-2018-1000074: RubyGems Deserialization of Untrusted Data vulnerability](https://junglewise.ai/threats/cve-2018-1000074-rubygems-deserialization-of-untrusted-data-vulnerability) (low, CVSS 3, published 14 May 2022) - [CVE-2018-1000076: RubyGems Improper Verification of Cryptographic Signature vulnerability](https://junglewise.ai/threats/cve-2018-1000076-rubygems-improper-verification-of-cryptographic-signature) (low, CVSS 3, published 14 May 2022) - [CVE-2018-1000077: RubyGems Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2018-1000077-rubygems-improper-input-validation-vulnerability) (low, CVSS 3, published 14 May 2022) - [CVE-2018-1000078: RubyGems Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2018-1000078-rubygems-cross-site-scripting-vulnerability) (low, CVSS 3, published 14 May 2022) - [CVE-2018-1000075: RubyGems Infinite Loop vulnerability](https://junglewise.ai/threats/cve-2018-1000075-rubygems-infinite-loop-vulnerability) (low, CVSS 3, published 13 May 2022) - [CVE-2017-0901: RubyGems may allow a maliciously crafted gem to overwrite files](https://junglewise.ai/threats/cve-2017-0901-rubygems-may-allow-a-maliciously-crafted-gem-to-overwrite-files) (low, CVSS 3, published 13 May 2022) - [CVE-2017-0903: RubyGems vulnerable to Deserialization of Untrusted Data](https://junglewise.ai/threats/cve-2017-0903-rubygems-vulnerable-to-deserialization-of-untrusted-data) (low, CVSS 3, published 13 May 2022) - [CVE-2017-0899: RubyGems Code Injection vulnerability](https://junglewise.ai/threats/cve-2017-0899-rubygems-code-injection-vulnerability) (low, CVSS 3, published 13 May 2022) - [CVE-2017-0902: RubyGems has Origin Validation Error vulnerability](https://junglewise.ai/threats/cve-2017-0902-rubygems-has-origin-validation-error-vulnerability) (low, CVSS 3, published 13 May 2022) - [CVE-2018-1000073: RubyGems Link Following vulnerability](https://junglewise.ai/threats/cve-2018-1000073-rubygems-link-following-vulnerability) (low, CVSS 3, published 13 May 2022) - [CVE-2007-0469: RubyGems file overwrite vulnerability](https://junglewise.ai/threats/cve-2007-0469-rubygems-file-overwrite-vulnerability) (info, published 1 May 2022) - [CVE-2019-8325: RubyGems Escape sequence injection in errors](https://junglewise.ai/threats/cve-2019-8325-rubygems-escape-sequence-injection-in-errors) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2019-8320: RubyGems Delete directory using symlink when decompressing tar](https://junglewise.ai/threats/cve-2019-8320-rubygems-delete-directory-using-symlink-when-decompressing-tar) (low, CVSS 3, published 20 Jun 2019) - [CVE-2019-8324: Code injection in RubyGems](https://junglewise.ai/threats/cve-2019-8324-code-injection-in-rubygems) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2019-8321: RubyGems Escape sequence injection vulnerability in verbose](https://junglewise.ai/threats/cve-2019-8321-rubygems-escape-sequence-injection-vulnerability-in-verbose) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2019-8322: RubyGems Escape sequence injection vulnerability in gem owner](https://junglewise.ai/threats/cve-2019-8322-rubygems-escape-sequence-injection-vulnerability-in-gem-owner) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2019-8323: RubyGems Escape sequence injection vulnerability in api response handling](https://junglewise.ai/threats/cve-2019-8323-rubygems-escape-sequence-injection-vulnerability-in-api-response) (low, CVSS 3.1, published 20 Jun 2019) ## Most severe rubygems-update (RubyGems) vulnerabilities - [CVE-2019-8325: RubyGems Escape sequence injection in errors](https://junglewise.ai/threats/cve-2019-8325-rubygems-escape-sequence-injection-in-errors) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2019-8321: RubyGems Escape sequence injection vulnerability in verbose](https://junglewise.ai/threats/cve-2019-8321-rubygems-escape-sequence-injection-vulnerability-in-verbose) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2019-8322: RubyGems Escape sequence injection vulnerability in gem owner](https://junglewise.ai/threats/cve-2019-8322-rubygems-escape-sequence-injection-vulnerability-in-gem-owner) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2019-8323: RubyGems Escape sequence injection vulnerability in api response handling](https://junglewise.ai/threats/cve-2019-8323-rubygems-escape-sequence-injection-vulnerability-in-api-response) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2019-8324: Code injection in RubyGems](https://junglewise.ai/threats/cve-2019-8324-code-injection-in-rubygems) (low, CVSS 3.1, published 20 Jun 2019) - [CVE-2017-0901: RubyGems may allow a maliciously crafted gem to overwrite files](https://junglewise.ai/threats/cve-2017-0901-rubygems-may-allow-a-maliciously-crafted-gem-to-overwrite-files) (low, CVSS 3, published 13 May 2022) - [CVE-2017-0903: RubyGems vulnerable to Deserialization of Untrusted Data](https://junglewise.ai/threats/cve-2017-0903-rubygems-vulnerable-to-deserialization-of-untrusted-data) (low, CVSS 3, published 13 May 2022) - [CVE-2017-0899: RubyGems Code Injection vulnerability](https://junglewise.ai/threats/cve-2017-0899-rubygems-code-injection-vulnerability) (low, CVSS 3, published 13 May 2022) - [CVE-2017-0900: RubyGems Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2017-0900-rubygems-improper-input-validation-vulnerability) (low, CVSS 3, published 14 May 2022) - [CVE-2018-1000073: RubyGems Link Following vulnerability](https://junglewise.ai/threats/cve-2018-1000073-rubygems-link-following-vulnerability) (low, CVSS 3, published 13 May 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other RubyGems technologies - [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack): 77 vulnerabilities - [nokogiri (RubyGems)](https://junglewise.ai/threats/technologies/nokogiri): 69 vulnerabilities - [rack (RubyGems)](https://junglewise.ai/threats/technologies/rack): 55 vulnerabilities - [activerecord (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-activerecord): 26 vulnerabilities - [puppet (RubyGems)](https://junglewise.ai/threats/technologies/puppet): 23 vulnerabilities - [activesupport (RubyGems)](https://junglewise.ai/threats/technologies/activesupport): 20 vulnerabilities - [actionview (RubyGems)](https://junglewise.ai/threats/technologies/actionview): 19 vulnerabilities - [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage): 19 vulnerabilities - [camaleon_cms (RubyGems)](https://junglewise.ai/threats/technologies/camaleon-cms): 19 vulnerabilities - [rails-html-sanitizer (RubyGems)](https://junglewise.ai/threats/technologies/rails-html-sanitizer): 18 vulnerabilities - [loofah (RubyGems)](https://junglewise.ai/threats/technologies/loofah): 17 vulnerabilities - [publify_core (RubyGems)](https://junglewise.ai/threats/technologies/publify-core): 15 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "rubygems-update (RubyGems) vulnerabilities", https://junglewise.ai/threats/technologies/rubygems-update, 13 November 2026.