# RubyGems package vulnerabilities Source: https://junglewise.ai/threats/vendors/rubygems Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/rubygems.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 1,195 vulnerabilities in RubyGems packages: 41 in the last 7 days and 87 in the last 90 days, 30 of them critical and 5 exploited in the wild. The most recent, CVE-2026-126366, was published on 13 November 2026. 9 vulnerabilities in the last four weeks, down 44% on the four before (16). 2 critical against 2. 97 packages have a page of their own. ## Counts - Last 7 days: 41 - Last 30 days: 50 - Last 90 days: 87 - All time: 1195 (30 critical, 5 exploited in the wild) ## About RubyGems The package manager and hosting service for the Ruby programming language. ## Latest RubyGems package vulnerabilities - [CVE-2026-126366: msgpack-ruby JRuby decoder uncapped memory allocation on malformed headers](https://junglewise.ai/threats/cve-2026-126366-msgpack-ruby-jruby-decoder-makes-uncapped-header-count) (high, CVSS 7.5, published 13 Nov 2026) - [CVE-2026-126354: Addressable URI.normalize_path path traversal and bypass](https://junglewise.ai/threats/cve-2026-126354-addressable-uri-normalization-resolves-some-dotted-path-segments) (medium, CVSS 4.8, published 12 Nov 2026) - [CVE-2026-126352: Addressable URI template ReDoS denial of service](https://junglewise.ai/threats/cve-2026-126352-addressable-is-an-alternative-implementation-to-the-uri) (medium, CVSS 5.9, published 12 Nov 2026) - [CVE-2026-126351: Addressable URI path normalization denial of service](https://junglewise.ai/threats/cve-2026-126351-addressable-is-an-alternative-implementation-to-the-uri) (medium, CVSS 5.9, published 12 Nov 2026) - [CVE-2026-126350: Addressable regular expression denial of service in URI template matching](https://junglewise.ai/threats/cve-2026-126350-addressable-is-an-alternative-implementation-to-the-uri) (medium, CVSS 5.9, published 12 Nov 2026) - [CVE-2026-126349: Addressable display_uri can show misleading hosts containing bidi and invisible characters](https://junglewise.ai/threats/cve-2026-126349-addressable-is-an-alternative-implementation-to-the-uri) (low, CVSS 3.1, published 12 Nov 2026) - [CVE-2026-126348: Addressable punycode decoding host spoofing](https://junglewise.ai/threats/cve-2026-126348-addressable-is-an-alternative-implementation-to-the-uri) (medium, CVSS 4.3, published 12 Nov 2026) - [CVE-2026-126209: Loofah allowed_uri? XSS bypass via numeric character reference](https://junglewise.ai/threats/cve-2026-126209-loofah-is-a-general-library-for-manipulating-and-transforming) (medium, published 12 Nov 2026) - [CVE-2026-126208: Loofah SVG href sanitization bypass in textPath and mpath](https://junglewise.ai/threats/cve-2026-126208-loofah-is-a-general-library-for-manipulating-and-transforming) (medium, CVSS 4.7, published 12 Nov 2026) - [CVE-2026-126207: Loofah CSS url() sanitization bypass via escaped parentheses](https://junglewise.ai/threats/cve-2026-126207-loofah-css-url-sanitization-bypass-via-escaped-parentheses) (medium, CVSS 4.7, published 12 Nov 2026) - [CVE-2026-126206: Loofah HTML5 Scrub XSS bypass via HTML entity encoding in data URIs](https://junglewise.ai/threats/cve-2026-126206-loofah-allowed-uri-treats-data-text-sol-html-as-safe-text-plain) (medium, published 12 Nov 2026) - [CVE-2026-126205: Loofah regular expression denial of service in SVG local-reference check](https://junglewise.ai/threats/cve-2026-126205-loofah-regular-expression-denial-of-service-in-the-svg-local) (medium, CVSS 5.3, published 12 Nov 2026) - [CVE-2026-107360: rubygem-safemode Jail allow-list bypass in compound assignment](https://junglewise.ai/threats/cve-2026-107360-a-flaw-was-found-in-rubygem-safemode-compound-assignment) (critical, CVSS 9.6, published 12 Nov 2026) - [CVE-2026-126203: Loofah HTML5 scrubber markup injection with Nokogiri](https://junglewise.ai/threats/cve-2026-126203-loofah-is-a-general-library-for-manipulating-and-transforming) (medium, CVSS 6.1, published 12 Nov 2026) - [CVE-2026-126188: Active Storage: Possible local file disclosure in video previews and analysis](https://junglewise.ai/threats/cve-2026-126188-active-storage-makes-it-simple-to-upload-and-reference-files-in) (low, CVSS 3.7, published 11 Nov 2026) - [CVE-2026-126186: Ruby on Rails Active Storage arbitrary file read and RCE in media processing](https://junglewise.ai/threats/cve-2026-126186-active-storage-possible-arbitrary-file-read-and-remote-code) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-126085: Ruby on Rails Active Storage content length bypass in Google Cloud Storage uploads](https://junglewise.ai/threats/cve-2026-126085-active-storage-possible-circumvention-of-file-size-limits-in) (medium, CVSS 5.3, published 10 Nov 2026) - [CVE-2026-126084: Ruby on Rails Active Storage GCS signature bypass](https://junglewise.ai/threats/cve-2026-126084-active-storage-makes-it-simple-to-upload-and-reference-files-in) (medium, CVSS 4.7, published 10 Nov 2026) - [CVE-2026-126083: Rails Action Pack remote IP spoofing in request handling](https://junglewise.ai/threats/cve-2026-126083-action-pack-is-a-framework-for-handling-and-responding-to-web) (high, CVSS 7.4, published 10 Nov 2026) - [CVE-2026-126081: Rails Action Pack mass assignment bypass in Parameters#each_key](https://junglewise.ai/threats/cve-2026-126081-action-pack-is-a-framework-for-handling-and-responding-to-web) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-126080: Rails Active Support regular expression injection in safe_constantize](https://junglewise.ai/threats/cve-2026-126080-active-support-is-a-collection-of-utility-classes-and-standard) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-126079: Rails Action View XSS via HTML5 sanitizer in text helpers](https://junglewise.ai/threats/cve-2026-126079-action-view-is-a-framework-for-handling-view-template-lookup-and) (medium, CVSS 6.1, published 10 Nov 2026) - [CVE-2026-126078: Rails Action View TextHelper highlight XSS](https://junglewise.ai/threats/cve-2026-126078-action-view-is-a-framework-for-handling-view-template-lookup-and) (medium, CVSS 6.1, published 10 Nov 2026) - [CVE-2026-126077: Rails Action Pack session cookie exposure in cached responses](https://junglewise.ai/threats/cve-2026-126077-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 6.8, published 10 Nov 2026) - [CVE-2026-126076: Ruby on Rails Action Pack session restoration after logout](https://junglewise.ai/threats/cve-2026-126076-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 4.2, published 10 Nov 2026) ## Most severe RubyGems package vulnerabilities - [CVE-2023-0669: Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework](https://junglewise.ai/threats/cve-2023-0669-fortra-goanywhere-mft-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 6 Feb 2023) - [CVE-2019-5418: Path Traversal in Action View](https://junglewise.ai/threats/cve-2019-5418-ruby-on-rails-path-traversal-in-action-view) (critical, exploited in the wild, CVSS 3.1, published 13 Mar 2019) - [CVE-2020-11023: jQuery DOM manipulation XSS via option elements](https://junglewise.ai/threats/cve-2020-11023-jquery-cross-site-scripting-xss-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 29 Apr 2020) - [CVE-2014-0130: actionpack Path Traversal vulnerability](https://junglewise.ai/threats/cve-2014-0130-ruby-on-rails-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 24 Oct 2017) - [CVE-2016-0752: Directory traversal vulnerability in Action View in Ruby on Rails](https://junglewise.ai/threats/cve-2016-0752-ruby-on-rails-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 3, published 24 Oct 2017) - [CVE-2026-55107: Kobako sandbox escape via public_send reflection](https://junglewise.ai/threats/cve-2026-55107-kobako-sandbox-escape-via-public-send-reflection) (critical, CVSS 10, published 30 Sep 2026) - [CVE-2026-77602: OpenC3 COSMOS authenticated remote code execution via config overlay](https://junglewise.ai/threats/cve-2026-77602-openc3-cosmos-authenticated-remote-code-execution-via-config) (critical, CVSS 9.9, published 23 Sep 2026) - [CVE-2019-11068: Nokogiri libxslt protection mechanism bypass via crafted URL](https://junglewise.ai/threats/cve-2019-11068-nokogiri-libxslt-protection-mechanism-bypass-via-crafted-url) (critical, CVSS 9.8, published 13 May 2022) - [CVE-2022-32224: Ruby on Rails Active Record RCE via YAML Deserialization in Serialized Columns](https://junglewise.ai/threats/cve-2022-32224-ruby-on-rails-active-record-rce-via-yaml-deserialization-in) (critical, CVSS 9.8, published 5 Dec 2022) - [CVE-2022-32511: JMESPath for Ruby unsafe deserialization in jmespath.rb](https://junglewise.ai/threats/cve-2022-32511-jmespath-for-ruby-unsafe-deserialization-in-jmespath-rb) (critical, CVSS 9.8, published 7 Jun 2022) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, down 44% on the four before (16). 2 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 17 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 7 | 0 | 0 | | 21 Sep 2026 | 5 | 1 | 0 | | 28 Sep 2026 | 2 | 1 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 6 | 0 | 0 | | 2 Nov 2026 | 3 | 2 | 0 | | 9 Nov 2026 | 41 | 1 | 0 | ## RubyGems packages - [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack): 77 vulnerabilities - [nokogiri (RubyGems)](https://junglewise.ai/threats/technologies/nokogiri): 69 vulnerabilities - [rack (RubyGems)](https://junglewise.ai/threats/technologies/rack): 55 vulnerabilities - [activerecord (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-activerecord): 26 vulnerabilities - [rubygems-update (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-update): 25 vulnerabilities - [puppet (RubyGems)](https://junglewise.ai/threats/technologies/puppet): 23 vulnerabilities - [activesupport (RubyGems)](https://junglewise.ai/threats/technologies/activesupport): 20 vulnerabilities - [actionview (RubyGems)](https://junglewise.ai/threats/technologies/actionview): 19 vulnerabilities - [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage): 19 vulnerabilities - [camaleon_cms (RubyGems)](https://junglewise.ai/threats/technologies/camaleon-cms): 19 vulnerabilities - [rails-html-sanitizer (RubyGems)](https://junglewise.ai/threats/technologies/rails-html-sanitizer): 18 vulnerabilities - [loofah (RubyGems)](https://junglewise.ai/threats/technologies/loofah): 17 vulnerabilities - [publify_core (RubyGems)](https://junglewise.ai/threats/technologies/publify-core): 15 vulnerabilities - [puma (RubyGems)](https://junglewise.ai/threats/technologies/puma): 15 vulnerabilities - [passenger (RubyGems)](https://junglewise.ai/threats/technologies/passenger): 14 vulnerabilities - [decidim (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-decidim): 13 vulnerabilities - [fat_free_crm (RubyGems)](https://junglewise.ai/threats/technologies/fat-free-crm): 12 vulnerabilities - [jquery-rails (RubyGems)](https://junglewise.ai/threats/technologies/jquery-rails): 11 vulnerabilities - [oj (RubyGems)](https://junglewise.ai/threats/technologies/oj): 11 vulnerabilities - [openc3 (RubyGems)](https://junglewise.ai/threats/technologies/openc3): 11 vulnerabilities - [rails (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-rails): 11 vulnerabilities - [net-imap (RubyGems)](https://junglewise.ai/threats/technologies/net-imap): 10 vulnerabilities - [ruby-saml (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-ruby-saml): 10 vulnerabilities - [decidim-core (RubyGems)](https://junglewise.ai/threats/technologies/decidim-core): 9 vulnerabilities - [spree (RubyGems)](https://junglewise.ai/threats/technologies/spree): 9 vulnerabilities - [addressable (RubyGems)](https://junglewise.ai/threats/technologies/addressable): 8 vulnerabilities - [avo (RubyGems)](https://junglewise.ai/threats/technologies/avo): 8 vulnerabilities - [jquery-ui-rails (RubyGems)](https://junglewise.ai/threats/technologies/jquery-ui-rails): 8 vulnerabilities - [katello (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-katello): 8 vulnerabilities - [rexml (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-rexml): 8 vulnerabilities - [fluentd (RubyGems)](https://junglewise.ai/threats/technologies/fluentd): 7 vulnerabilities - [lodash-rails (RubyGems)](https://junglewise.ai/threats/technologies/lodash-rails): 7 vulnerabilities - [doorkeeper (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-doorkeeper): 7 vulnerabilities - [cgi (RubyGems)](https://junglewise.ai/threats/technologies/cgi): 6 vulnerabilities - [commonmarker (RubyGems)](https://junglewise.ai/threats/technologies/commonmarker): 6 vulnerabilities - [ember-source (RubyGems)](https://junglewise.ai/threats/technologies/ember-source): 6 vulnerabilities - [devise (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-devise): 6 vulnerabilities - [json (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-json): 6 vulnerabilities - [mcp (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-mcp): 6 vulnerabilities - [webrick (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-webrick): 6 vulnerabilities - [sinatra (RubyGems)](https://junglewise.ai/threats/technologies/sinatra): 6 vulnerabilities - [view_component (RubyGems)](https://junglewise.ai/threats/technologies/view-component): 6 vulnerabilities - [bundler (RubyGems)](https://junglewise.ai/threats/technologies/bundler): 5 vulnerabilities - [carrierwave (RubyGems)](https://junglewise.ai/threats/technologies/carrierwave): 5 vulnerabilities - [crass (RubyGems)](https://junglewise.ai/threats/technologies/crass): 5 vulnerabilities - [mail (RubyGems)](https://junglewise.ai/threats/technologies/mail): 5 vulnerabilities - [rubyzip (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-rubyzip): 5 vulnerabilities - [safemode (RubyGems)](https://junglewise.ai/threats/technologies/safemode): 5 vulnerabilities - [sidekiq (RubyGems)](https://junglewise.ai/threats/technologies/sidekiq): 5 vulnerabilities - [spree_auth_devise (RubyGems)](https://junglewise.ai/threats/technologies/spree-auth-devise): 5 vulnerabilities - [yard (RubyGems)](https://junglewise.ai/threats/technologies/yard): 5 vulnerabilities - [action_text-trix (RubyGems)](https://junglewise.ai/threats/technologies/action-text-trix): 4 vulnerabilities - [activeadmin (RubyGems)](https://junglewise.ai/threats/technologies/activeadmin): 4 vulnerabilities - [alchemy_cms (RubyGems)](https://junglewise.ai/threats/technologies/alchemy-cms): 4 vulnerabilities - [decidim-admin (RubyGems)](https://junglewise.ai/threats/technologies/decidim-admin): 4 vulnerabilities - [devise-two-factor (RubyGems)](https://junglewise.ai/threats/technologies/devise-two-factor): 4 vulnerabilities - [httparty (RubyGems)](https://junglewise.ai/threats/technologies/httparty): 4 vulnerabilities - [omniauth (RubyGems)](https://junglewise.ai/threats/technologies/omniauth): 4 vulnerabilities - [phlex (RubyGems)](https://junglewise.ai/threats/technologies/phlex): 4 vulnerabilities - [rails_admin (RubyGems)](https://junglewise.ai/threats/technologies/rails-admin): 4 vulnerabilities - [bootstrap-sass (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-bootstrap-sass): 4 vulnerabilities - [dragonfly (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-dragonfly): 4 vulnerabilities - [grpc (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-grpc): 4 vulnerabilities - [mechanize (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-mechanize): 4 vulnerabilities - [sanitize (RubyGems)](https://junglewise.ai/threats/technologies/sanitize): 4 vulnerabilities - [spree_api (RubyGems)](https://junglewise.ai/threats/technologies/spree-api): 4 vulnerabilities - [sqlite3 (RubyGems)](https://junglewise.ai/threats/technologies/sqlite3): 4 vulnerabilities - [uri (RubyGems)](https://junglewise.ai/threats/technologies/uri): 4 vulnerabilities - [websocket-driver (RubyGems)](https://junglewise.ai/threats/technologies/websocket-driver): 4 vulnerabilities - [chartkick (RubyGems)](https://junglewise.ai/threats/technologies/chartkick): 3 vulnerabilities - [concurrent-ruby (RubyGems)](https://junglewise.ai/threats/technologies/concurrent-ruby): 3 vulnerabilities - [decidim-verifications (RubyGems)](https://junglewise.ai/threats/technologies/decidim-verifications): 3 vulnerabilities - [doorkeeper-openid_connect (RubyGems)](https://junglewise.ai/threats/technologies/doorkeeper-openid-connect): 3 vulnerabilities - [faraday (RubyGems)](https://junglewise.ai/threats/technologies/faraday): 3 vulnerabilities - [geminabox (RubyGems)](https://junglewise.ai/threats/technologies/geminabox): 3 vulnerabilities - [gollum (RubyGems)](https://junglewise.ai/threats/technologies/gollum): 3 vulnerabilities - [iodine (RubyGems)](https://junglewise.ai/threats/technologies/iodine): 3 vulnerabilities - [json-jwt (RubyGems)](https://junglewise.ai/threats/technologies/json-jwt): 3 vulnerabilities - [mpxj (RubyGems)](https://junglewise.ai/threats/technologies/mpxj): 3 vulnerabilities - [oauth (RubyGems)](https://junglewise.ai/threats/technologies/oauth): 3 vulnerabilities - [omniauth-saml (RubyGems)](https://junglewise.ai/threats/technologies/omniauth-saml): 3 vulnerabilities - [private_address_check (RubyGems)](https://junglewise.ai/threats/technologies/private-address-check): 3 vulnerabilities - [prosemirror_to_html (RubyGems)](https://junglewise.ai/threats/technologies/prosemirror-to-html): 3 vulnerabilities - [rack-cors (RubyGems)](https://junglewise.ai/threats/technologies/rack-cors): 3 vulnerabilities - [rdoc (RubyGems)](https://junglewise.ai/threats/technologies/rdoc): 3 vulnerabilities - [resque (RubyGems)](https://junglewise.ai/threats/technologies/resque): 3 vulnerabilities - [rest-client (RubyGems)](https://junglewise.ai/threats/technologies/rest-client): 3 vulnerabilities - [bootstrap (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-bootstrap): 3 vulnerabilities - [git (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-git): 3 vulnerabilities - [google-protobuf (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-google-protobuf): 3 vulnerabilities - [openssl (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-openssl): 3 vulnerabilities - [paperclip (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-paperclip): 3 vulnerabilities - [secure_headers (RubyGems)](https://junglewise.ai/threats/technologies/secure-headers): 3 vulnerabilities - [spina (RubyGems)](https://junglewise.ai/threats/technologies/spina): 3 vulnerabilities - [sprockets (RubyGems)](https://junglewise.ai/threats/technologies/sprockets): 3 vulnerabilities - [sqlite3-ruby (RubyGems)](https://junglewise.ai/threats/technologies/sqlite3-ruby): 3 vulnerabilities - [zlib (RubyGems)](https://junglewise.ai/threats/technologies/zlib): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "RubyGems package vulnerabilities", https://junglewise.ai/threats/vendors/rubygems, 13 November 2026.