Security · High impactFan score 70 · Tier A
Even gem list can run someone else's code
The Brief
- Ruby gems can run code during installation and on every gem command, including gem list.
- Aikido Security reports four gems that exfiltrate data.
- Mitigations are to check for the four flagged gems and turn off install-time code execution.
Why it matters
Simply listing installed gems can run third-party code, so malicious gems can leak data from developer machines even without being used.
Who’s affected
- Ruby developers
- Anyone running gem install or gem list
What to do
- Check installed gems for the four data-exfiltrating gems named in the Aikido Security report
- Turn off install-time code execution for gems
- #ruby
- #rubygems
- #supply-chain
- #security
- #malware
Ruby gems can run code on install and on every gem command, even gem list. Check for four data-exfiltrating gems and turn off install-time execution. Category: Vulnerabilities & Threats
Timeline
Aikido Security published its report on code execution through gem list
Aikido Security's Blog
Even gem list can run someone else's code