Bundler is still vulnerable to dependency confusion attacks

Bundler is vulnerable to dependency confusion attacks if you have any implicit private dependencies, and has been since version 1.16.0, released in October 2017. The latest version at the time of writing, 2.2.17, is still vulnerable. There are some mitigations available.

https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/