VulnerabilityPublished 25 Jun 2024Updated 18 Jul 2026

codon (RubyGems) · Malicious Code

Affects codonSource GCVE Database

Severity

High

Rated by Threat Radar

Data as of 19 Jul 2026, 00:42 UTC

What to do

Affected software

Product	Affected	Fixed in
RubyGemscodon`pkg:gem/codon`Other threats	Affected =22.55.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Users should avoid using 'codon' version 22.55.2 and instead use a version not flagged as malicious or remove the package if already installed. Monitor official RubyGems advisories and the OpenSSF malicious packages database for updates or remediation guidance.

Description

The RubyGems package 'codon' version 22.55.2 contains malicious code as identified by the OpenSSF malicious packages database. This is a supply chain threat involving a malicious package published to the RubyGems ecosystem. No CVSS score or detailed technical exploitation information is provided.

Impact

Use of the affected 'codon' package version 22.55.2 may result in execution of malicious code embedded within the package. This could compromise the security of systems or applications that install and run this version of the package. No specific impact details or exploitation reports are available.

Summary

The 'codon' RubyGems package at version 22.55.2 has been flagged for containing malicious code. This identification comes from the OpenSSF malicious packages project and is cataloged under MAL-2024-6837. There is no detailed vulnerability or exploit description, nor any known exploits in the wild. The threat is a malicious package insertion rather than a traditional software vulnerability.

References

github.com/advisories/GHSA-xw67-5q7g-2mr8 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Jul 2026, 00:42 UTC

Technical details

References

Community reviews