CVE-2026-55107 is a critical-severity (CVSS 10) Code Injection vulnerability in kobako. A fix is available for kobako — see the affected versions and patch details below.
Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-55107.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-55107 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 382,205 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
kobakoReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox.
Details
A host embeds bound "Service" objects that guest scripts call across the wasm
boundary through the transport dispatcher. The dispatcher passed the
guest-supplied method name straight to Object#public_send on the bound
object, with no restriction to the object's own methods:
target.public_send(method.to_sym, *args, **kwargs, &block)
public_send can invoke any public method, including Ruby's ambient
reflection surface. A guest pivots through the public send into otherwise
private Kernel methods: a dispatch request with method = "send" and
args = [:eval, "<ruby>"] evaluates to target.send(:eval, "<ruby>"),
running attacker-controlled Ruby in the host. Any bound Service object is
sufficient — no Service-specific behavior is required.
Proof of Concept
A guest call equivalent to:
Service.send(:eval, "<arbitrary host ruby>")
executes in the host process and can read or modify host state, spawn processes, and so on.
Impact
Complete sandbox escape leading to remote code execution in the host process,
defeating the gem's central guarantee of isolating untrusted mruby scripts.
Any deployment that runs untrusted or attacker-influenced scripts is affected.
All released versions (0.1.0 through 0.9.0) are vulnerable; the dispatcher
carried the same unguarded public_send sink under three successive names
(registry → rpc → transport).
Patches
Fixed in 0.9.1. The dispatcher now rejects any method whose resolved owner is
a core/meta module (BasicObject, Kernel, Object, Module, Class), so
only methods the bound object itself defines — or dynamically handles via
method_missing — remain reachable. The ambient reflection methods (send,
__send__, public_send, instance_eval, instance_exec, method,
instance_variable_get, …) are all owned by those modules and are blocked.
Workarounds
None within the affected versions. Until you can upgrade, do not bind any host Service object into a sandbox that runs untrusted scripts. Upgrade to 0.9.1.
References
- GHSA-7pwq-q9jf-539h
- Fix commit: 64f8470
Credits
Reported and fixed by Ahmed Al Hafoudh.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | kobako | ≥ 0.1.0&&< 0.9.1 | 0.9.1bundle update kobako --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for kobako, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update kobako to 0.9.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55107 is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Frequently Asked Questions
Is CVE-2026-55107 in your dependencies?
Find it across RubyGems, including transitive dependencies.