EUVD-2026-68102

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

CVE-2026-82455

RubyGems versions before 4.0.13 are vulnerable to a path traversal issue during gem extraction. The root cause is a failure to re-validate path containment after filesystem symlink resolution : if a pre-existing symlink inside the destination directory points outside the extraction root, extracte...