CVE-2026-55107 is a critical-severity (CVSS 10) remote code execution vulnerability in kobako. O3 Security confirms whether CVE-2026-55107 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
Real-World Exposure
kobakoReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox.
Details
A host embeds bound "Service" objects that guest scripts call across the wasm
boundary through the transport dispatcher. The dispatcher passed the
guest-supplied method name straight to Object#public_send on the bound
object, with no restriction to the object's own methods:
target.public_send(method.to_sym, *args, **kwargs, &block)
public_send can invoke any public method, including Ruby's ambient
reflection surface. A guest pivots through the public send into otherwise
private Kernel methods: a dispatch request with method = "send" and
args = [:eval, "<ruby>"] evaluates to target.send(:eval, "<ruby>"),
running attacker-controlled Ruby in the host. Any bound Service object is
sufficient — no Service-specific behavior is required.
Proof of Concept
A guest call equivalent to:
Service.send(:eval, "<arbitrary host ruby>")
executes in the host process and can read or modify host state, spawn processes, and so on.
Impact
Complete sandbox escape leading to remote code execution in the host process,
defeating the gem's central guarantee of isolating untrusted mruby scripts.
Any deployment that runs untrusted or attacker-influenced scripts is affected.
All released versions (0.1.0 through 0.9.0) are vulnerable; the dispatcher
carried the same unguarded public_send sink under three successive names
(registry → rpc → transport).
Patches
Fixed in 0.9.1. The dispatcher now rejects any method whose resolved owner is
a core/meta module (BasicObject, Kernel, Object, Module, Class), so
only methods the bound object itself defines — or dynamically handles via
method_missing — remain reachable. The ambient reflection methods (send,
__send__, public_send, instance_eval, instance_exec, method,
instance_variable_get, …) are all owned by those modules and are blocked.
Workarounds
None within the affected versions. Until you can upgrade, do not bind any host Service object into a sandbox that runs untrusted scripts. Upgrade to 0.9.1.
References
- GHSA-7pwq-q9jf-539h
- Fix commit: 64f8470
Credits
Reported and fixed by Ahmed Al Hafoudh.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | kobako | ≥ 0.1.0&&< 0.9.1 | 0.9.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for kobako. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update kobako to 0.9.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55107 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-55107 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-55107. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-55107 in your dependencies?
O3 detects CVE-2026-55107 across RubyGems dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.