CVE-2015-3649: The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under...

Security readout for executives and security teams

CVE-2015-3649 affects the open-uri-cached Ruby gem. A local user on the same system may be able to make the gem load attacker-controlled Ruby content through its temporary cache metadata handling. This is most relevant on shared hosts, build boxes, or servers where untrusted users have local access. Exposure is likely limited to Ruby environments that use the open-uri-cached gem and share a host with untrusted local users. Internet-facing reachability alone is not shown by the sources. Treat as a targeted local-risk dependency issue, not a broad internet emergency. Prioritize shared infrastructure, developer workstations, CI systems, and production hosts where untrusted local access exists. Mitigation focus: Inventory Ruby applications and lockfiles for open-uri-cached usage.; Check upstream or distribution guidance for fixed or recommended replacement versions.; Remove or replace the gem where practical, especially on shared systems..

Prepared

Jun 12, 2026, 21:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.