RUBYGEMS · TECH-202611-e3mx3j · Package
NO FIX YET · SEE WHAT TO DO
Aikido Security research (published 5 Nov 2026, updated 9 Nov): a Ruby gem can run code on your machine through native extension build files declared in its gemspec (extconf.rb, mkrf_conf.rb, Rakefile), which RubyGems runs during gem install / bundle install, and through lib/rubygems_plugin.rb, which loads at the end of the install and again on every later gem command, including gem list, gem search and gem -v. Stable RubyGems and Bundler 4.0.x offer no way to disable either; RubyGems/Bundler 4.1.0.beta3 adds opt-out settings that are off by default. Reported to RubyGems security on 27 Oct 2026. The extension path was used by the malicious strutil-core 1.0.1 gem (tracked separately); four old research-style gems that phone home on install (xmastree, ancient-city-ruby, hacky, et_phone_home) were still installable on 4 Nov. Any developer machine or CI job that installs gems is exposed. No CVE.
first public Nov 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
0.0.1, 0.0.2), ancient-city-ruby (2013.1), hacky (0.0.2), et_phone_home (0.1.0)176.31.142.25Gem.path.each { |p| puts Dir.glob("#{p}/gems/*") }Gem.path.each { |p| puts Gem.plugindir(p) } and look for unexpected rubygems_plugin.rb filesPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
gem update --system 4.1.0.beta3, then gem install --no-build-extension --no-install-plugin bundle config set --global no_build_extension true and no_install_plugin true; in CI set BUNDLE_NO_BUILD_EXTENSION=true and BUNDLE_NO_INSTALL_PLUGIN=true (only skip extension builds in jobs that don't load the app)