Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2020-36327

CVE-2020-36327HIGH

n/a n/a — Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, whi…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0631   93.5     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 29  Reserved by mitre
  Apr 29  Published (CNA: mitre)
  Oct 8   ENRICHED — CVE-2020-36327. Received CVSS 8.8 and CPE data from NVD.
  Oct 8   EXPLOIT PUBLISHED — CVE-2020-36327. Public exploit reference added.

CNA: mitre · CVSS v3.1 · 6 references · NVD status: Modified

Description

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
April 29, 2021	Reserved	Reserved by mitre
April 29, 2021	Published	Published (CNA: mitre)
October 8, 2026	ENRICHED	ENRICHED — CVE-2020-36327. Received CVSS 8.8 and CPE data from NVD.
October 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2020-36327. Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	n/a	—	n/a	—

References (6)

https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html [Vendor Advisory]
https://github.com/rubygems/rubygems/issues/3982 [Exploit, Issue Tracking, Third Party Advisory]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/
https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/ [Third Party Advisory]
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105 [Patch, Vendor Advisory]
https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/ [Exploit, Third Party Advisory]

Authoritative record: CVE-2020-36327 at cve.org

About this page