A70/100
Supply-chain attack · high
Ruby gems can run code on install and during gem list
Tier A · Patch today – Before you go home
Who’s exposed: Developers installing the four flagged Ruby gems
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild · Full takeover · Secrets exposed · Supply chain
What to do
- Check installed gems for the four data-exfiltrating gems named in the Aikido Security report
- Turn off install-time code execution for gems
The Brief
- Ruby gems can run code during installation and on every gem command, including gem list.
- Aikido Security reports four gems that exfiltrate data.
- Mitigations are to check for the four flagged gems and turn off install-time code execution.
Why it matters
Simply listing installed gems can run third-party code, so malicious gems can leak data from developer machines even without being used.
The checklist behind the tier
Checklist · 6 of 10 yes
| Yes | Hits tech teams | Developers use RubyGems and the gem command to build and run Ruby software. |
| No | Core infrastructure | RubyGems is a language package registry, not core infrastructure like OpenSSH, glibc or npm/PyPI as a whole. |
| Yes | Popular tool | RubyGems and the gem CLI are mainstream package tooling used by many Ruby teams. |
| Yes | Exploited in the wild | Aikido Security Blog: check for four data-exfiltrating gems, indicating malicious gems actually published and in use. |
| No | Public exploit | Aikido Security Blog describes the issue and mitigation only; no published exploit code is mentioned. |
| No | Remote, no login | Aikido Security Blog: code runs on gem install or gem list, which requires local use of the gem tooling. |
| Yes | Full takeover | Aikido Security Blog: Ruby gems can run someone else's code on install and on every gem command. |
| Yes | Secrets exposed | Aikido Security Blog: four data-exfiltrating gems to check for, meaning data is exfiltrated. |
| Yes | Supply chain | Aikido Security Blog: four data-exfiltrating gems to check for, i.e. malicious packages published to RubyGems. |
| No | No fix yet | Aikido Security Blog recommends disabling install-time execution; it does not say no fix exists. |
Timeline
Aikido Security published its report on code execution through gem list
Aikido Security's Blog
Even gem list can run someone else's code
Source
Even gem list can run someone else's code ↗ Aikido Security's Blog · 20h ago
First seen · 1 source · Full story page · How tiers are decided