CVE-2019-3881: Files or Directories Accessible to External Parties
(updated )
Bundler uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user’s home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
References
Detect and mitigate CVE-2019-3881 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →