ruby/rubygems · error · Bundler::InsecureInstallPathError

38

38

Error message

Bundler cannot reinstall #{@name} because there's a previous installation of it at #{@path} that is unsafe to remove.
The parent of #{@path} is world-writable and does not have the sticky bit set, making it insecure to remove due to potential vulnerabilities.
Please change the permissions of #{File.dirname(@path)} or choose a different install path.

What it means

Error "Bundler cannot reinstall #{@name} because there's a previous installation of it at #{@path} that is unsafe to remove. The parent of #{@path} is world-writable and does not have the sticky bit set, making it insecure to remove due to potential vulnerabilities. Please change the permissions of #{File.dirname(@path)} or choose a different install path." thrown in ruby/rubygems.

Source

Thrown at lib/bundler/rubygems_gem_installer.rb:226

      # mode and raise "IOError: not opened for writing" when releasing slots.
      [IO.new(read_fd.to_i, "r", autoclose: false), IO.new(write_fd.to_i, "w", autoclose: false)]
    end

    def prepare_extension_build(extension_dir)
      SharedHelpers.filesystem_access(extension_dir, :create) do
        FileUtils.mkdir_p extension_dir
      end
    end

    def strict_rm_rf(dir)
      return unless File.exist?(dir)
      return if Dir.empty?(dir)

      parent = File.dirname(dir)
      parent_st = File.stat(parent)

      if parent_st.world_writable? && !parent_st.sticky?
        raise InsecureInstallPathError.new(spec.full_name, dir)
      end

      begin
        FileUtils.remove_entry_secure(dir)
      rescue StandardError => e
        raise unless File.exist?(dir)

        raise DirectoryRemovalError.new(e, "Could not delete previous installation of `#{dir}`")
      end
    end
  end
end

View on GitHub (pinned to 86cbb817a3)

When it happens

Trigger: Thrown at lib/bundler/rubygems_gem_installer.rb:226 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/019d97fbfa82c8e0. Report an issue: GitHub.