Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

tmpdir

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5RubyGemsPublished

    Tempfile on Windows path traversal vulnerability

    CVE-2021-28966 · GHSA-46f2-3v63-3xrp

    Affected
    • RubyGems tmpdir < 0.1.2
    Fixed in
    0.1.2· Vendor fix available
    Issue
    There is an unintentional directory creation vulnerability in tmpdir library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.

    Recommended action: Upgrade to 0.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →