CVE-2013-0334: Bundler

Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days.

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

Affected products

• Bundler Bundler: before 1.7.0 (fixed in 1.7.0)
• Fedoraproject Fedora: version 19 only; version 20 only; version 21 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only

Published 2014-10-31. Last modified 2026-06-16.