Read the docs
TI-2022-16496 Aliases CVE-2022-36073

RubyGems allows creation of users with arbitrary unverified emails

Priority MEDIUM 42CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01039 64th percentileScored 2026-11-07
Fix Fixed rubygems.org (rubygems): 90c9e6aac2d91518b479c51d48275c57de492d4d

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rubygemsrubygems.orgbefore 90c9e6aac2d91518b479c51d48275c57de492d4d90c9e6aac2d91518b479c51d48275c57de492d4dPatch availableCNA
  • rubygems.org Vendorrubygems Affected before 90c9e6aac2d91518b479c51d48275c57de492d4d Fixed in 90c9e6aac2d91518b479c51d48275c57de492d4d Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*before 2022-08-31Vulnerablerubygems
  • cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:* Versions before 2022-08-31 Vulnerable ·rubygems

Remediation

  • Fix · CNA rubygems.org (rubygems) Fixed in 90c9e6aac2d91518b479c51d48275c57de492d4d

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36073

References

Patch 2

  • TI-2017-00851 Deserialization of untrusted data in HackerOne RubyGems CVSS 3.0CRITICAL 9.8
  • TI-2017-00849 Path traversal in HackerOne RubyGems CVSS 3.0HIGH 7.5
  • TI-2017-00847 Code injection in HackerOne RubyGems CVSS 3.0CRITICAL 9.8
  • TI-2018-15731 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier… CVSS 3.0CRITICAL 9.8
  • TI-2019-05977 An issue was discovered in RubyGems 2.6 and later through 3.0.2. CVSS 3.1HIGH 8.8
  • TI-2017-00848 RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem… CVSS 3.0HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences