CVE-2026-55107

10 CRITICALpublic exploit available

Published 2026-09-30 · Updated 2026-09-30

AI risk analysis

Summary: Kobako Ruby gem versions before 0.9.1 allow guest mruby scripts to escape the sandbox and execute arbitrary Ruby code in the host process, leading to remote code execution.
Exploitability: Exploitation is relatively straightforward given the preconditions of running untrusted Ruby scripts in the Kobako sandbox.
Blast radius: If exploited, this flaw could lead to full compromise of the host system, including data theft, unauthorized code execution, and potential lateral movement.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Kobako version 0.9.1 or later.

rcewebrubysandbox-bypass

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-94, CWE-470

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.