Loading...
Skip to main content
GeekWala
Ruby

RubyGems Vulnerability Scanner

The Ruby community's gem hosting service. Powers Rails applications and Ruby projects worldwide.

Scan Your RubyGems ProjectCreate Free Account

Scan your Gemfile.lock online

Free dependency vulnerability scan for RubyGems — no signup required

Scan now

Common RubyGems Risk Types

Ruby gems have seen deserialization and code injection vulnerabilities. GeekWala identifies which RubyGems CVEs have EPSS exploitation scores above the critical threshold.

Deserialization
Code Injection
Command Injection

RubyGems Security Guide

Ruby Dependency Security Beyond bundler-audit

bundler-audit checks ruby-advisory-db and stops there. It won't tell you which gem vulnerabilities are actually being exploited. Learn how EPSS and CISA KEV signals change Ruby dependency prioritization for production Rails apps.

Related RubyGems reading

How to Scan RubyGems Projects

GeekWala supports the following Ruby dependency files

Supported Files

  • Gemfile.lock

Scan Methods

  • Upload your lockfile
  • Paste file contents
  • Import from GitHub

What You Get

  • Exploitation-ranked results (not just CVSS)
  • CISA KEV: flag CVEs actively attacked right now
  • EPSS: 30-day exploit probability per CVE
  • Cross-ecosystem: cover your full stack in one scan

Compare & learn more

RubyGems vs bundler-auditWhat Is Dependency Vulnerability Scanning?
745
Total Indexed
187
Critical
13
Actively Exploited (KEV)
requires immediate attention
9
New This Month

See how results are ranked by exploitation risk — KEV-flagged CVEs first, with EPSS scores.

See a live example

13 Known Exploited Vulnerabilities

These vulnerabilities are actively being exploited in the wild. Scan your project to check if you're affected.

Recent RubyGems Vulnerabilities

Latest security issues affecting Ruby packages

CRITICAL
GHSA-jjq7-m736-w977
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config …
CRITICAL
GHSA-7pwq-q9jf-539h
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_s…
CRITICAL
GHSA-xr9x-r78c-5hrm
Active Storage has possible arbitrary file read and remote code execution in Act…
CRITICAL
GHSA-44hj-4m45-frj3
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in…
CRITICAL
GHSA-8fq9-273g-6mrg
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorize…
View all vulnerabilities

Most Affected RubyGems Packages

Packages with the most known vulnerabilities

1
nokogiri
37 vulns
2
rack
36 vulns
3
actionpack
23 vulns
4
rubygems-update
16 vulns
5
rails-html-sanitizer
15 vulns
6
decidim
12 vulns
7
puma
12 vulns
8
activestorage
11 vulns
9
oj
11 vulns
10
openc3
11 vulns
11
publify_core
11 vulns
12
actionview
10 vulns
13
camaleon_cms
10 vulns
14
ruby-saml
10 vulns
15
decidim-core
9 vulns
Browse all RubyGems packages

Secure Your Ruby Dependencies

Scan your Gemfile against OSV. Results are ranked by exploitation probability — CVEs under active attack appear first, so you fix what's actually being exploited, not just what scores highest.

Start Free ScanRead the Docs

Also scan for

npmPyPIPackagistMavenGo Modulescrates.ioNuGet
Data from OSV Database745+ RubyGems vulnerabilities indexedUpdated daily