Is CVE-2022-29218 actively exploited?

No active exploitation of CVE-2022-29218 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-29218 be exploited remotely?

Yes. CVE-2022-29218 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-29218?

CVE-2022-29218 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2022-29218

HIGH

CVE-2022-29218

CWE-269Published: May 13, 2022· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN cache by a malicious package. The bug has been patched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue.

NVD Source

Technical Analysis

CVE-2022-29218 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.