-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe CVE description explicitly names the install_location function in package.rb as containing the vulnerability. The GitHub commit diff shows the vulnerable code was modified to add File.realpath checks to prevent symlink-based traversal. The patch confirms the original implementation lacked proper symlink resolution before path expansion, making this the clear vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rubygems-update | rubygems | < 2.7.6 | 2.7.6 |
| org.jruby:jruby-stdlib | maven | < 9.1.16.0 | 9.1.16.0 |