{"id":"CVE-2026-55107","kind":"vulnerability","aliases":["CVE-2026-55107","GHSA-7pwq-q9jf-539h"],"related":[],"title":"kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)","description":"### Summary\nA guest mruby script running inside the Kobako sandbox can execute arbitrary\nRuby in the host process, fully escaping the sandbox.\n\n### Details\nA host embeds bound \"Service\" objects that guest scripts call across the wasm\nboundary through the transport dispatcher. The dispatcher passed the\nguest-supplied method name straight to `Object#public_send` on the bound\nobject, with no restriction to the object's own methods:\n\n```ruby\ntarget.public_send(method.to_sym, *args, **kwargs, &block)\n```\n\n`public_send` can invoke any public method, including Ruby's ambient\nreflection surface. A guest pivots through the public `send` into otherwise\nprivate Kernel methods: a dispatch request with `method = \"send\"` and\n`args = [:eval, \"<ruby>\"]` evaluates to `target.send(:eval, \"<ruby>\")`,\nrunning attacker-controlled Ruby in the host. Any bound Service object is\nsufficient — no Service-specific behavior is required.\n\n### Proof of Concept\nA guest call equivalent to:\n\n```\nService.send(:eval, \"<arbitrary host ruby>\")\n```\n\nexecutes in the host process and can read or modify host state, spawn\nprocesses, and so on.\n\n### Impact\nComplete sandbox escape leading to remote code execution in the host process,\ndefeating the gem's central guarantee of isolating untrusted mruby scripts.\nAny deployment that runs untrusted or attacker-influenced scripts is affected.\nAll released versions (0.1.0 through 0.9.0) are vulnerable; the dispatcher\ncarried the same unguarded `public_send` sink under three successive names\n(`registry` → `rpc` → `transport`).\n\n### Patches\nFixed in 0.9.1. The dispatcher now rejects any method whose resolved owner is\na core/meta module (`BasicObject`, `Kernel`, `Object`, `Module`, `Class`), so\nonly methods the bound object itself defines — or dynamically handles via\n`method_missing` — remain reachable. The ambient reflection methods (`send`,\n`__send__`, `public_send`, `instance_eval`, `instance_exec`, `method`,\n`instance_variable_get`, …) are all owned by those modules and are blocked.\n\n### Workarounds\nNone within the affected versions. Until you can upgrade, do not bind any\nhost Service object into a sandbox that runs untrusted scripts. Upgrade to\n0.9.1.\n\n### References\n- GHSA-7pwq-q9jf-539h\n- Fix commit: 64f8470\n\n### Credits\nReported and fixed by Ahmed Al Hafoudh.","summary":"The kobako Ruby gem runs untrusted mruby scripts in a sandbox, but its dispatcher forwards guest-chosen method names to public_send on bound Service objects. A guest calling send with eval gets arbitrary Ruby execution in the host process.","severity":"critical","cvss":10.0,"epss":0.00799,"exploited":false,"exploited_at":null,"products":[{"name":"kobako","fixed":["0.9.1"],"affected":">= 0.1.0, <= 0.9.0","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-470","cwe-94","kobako","mruby","package","ruby","rubygems"],"not_affected_if":["kobako-at-0.9.1-or-later","no-bound-services","trusted-scripts-only"],"how_to_check":"- `gem list kobako` to see the installed kobako version\n- Check the Gemfile.lock for `kobako` and whether its version is at least `0.1.0` and at most `0.9.0`\n- Look for host code that binds Service objects into a Kobako sandbox running untrusted scripts","fix":"- Upgrade the kobako gem to `0.9.1`\n- Until upgraded, do not bind any host Service object into a sandbox that runs untrusted scripts","status":"open","published_at":"2026-08-18T20:09:59+00:00","first_seen_at":"2026-10-26T14:47:19+00:00","triaged_at":"2026-10-26T14:48:43+00:00","updated_at":"2026-10-26T14:48:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T14:48:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the kobako gem to `0.9.1`\n- Until upgraded, do not bind any host Service object into a sandbox that runs untrusted scripts","reach":"internet","title":"kobako: guest script escapes sandbox and runs Ruby on host","impact":"high","summary":"The kobako Ruby gem runs untrusted mruby scripts in a sandbox, but its dispatcher forwards guest-chosen method names to public_send on bound Service objects. A guest calling send with eval gets arbitrary Ruby execution in the host process.","category":"package","nicknames":[],"who_cares":["ruby","rubygems","kobako","mruby"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary Ruby code in the host process","analyst_note":"","how_to_check":"- `gem list kobako` to see the installed kobako version\n- Check the Gemfile.lock for `kobako` and whether its version is at least `0.1.0` and at most `0.9.0`\n- Look for host code that binds Service objects into a Kobako sandbox running untrusted scripts","needs_analyst":false,"not_affected_if":["kobako-at-0.9.1-or-later","trusted-scripts-only","no-bound-services"],"who_is_affected":"Any application that embeds the kobako gem and runs untrusted or attacker-influenced mruby scripts inside its sandbox, with host Service objects bound, is exposed in every release from 0.1.0 through 0.9.0. Applications that only run trusted scripts, or that bind no Service objects, are not reached by this flaw as described.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000714,"input_tokens":4169,"output_tokens":595,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,26A '-470':30B '-55107':19A,27A '-94':32B '0.1.0':280C '0.9.0':282C '0.9.1':304C,390C '539h':24A,396C '64f8470':399C '7pwq':22A,394C 'across':112C 'affect':276C,368C 'ahm':405C 'al':406C 'ambient':165C,340C 'arbitrari':72B,91C 'arg':152C,187C 'attack':195C,272C 'attacker-control':194C 'attacker-influenc':271C 'basicobject':318C 'behavior':211C 'bind':376C 'block':154C,363C 'bound':15A,62B,105C,136C,202C,327C 'boundari':115C 'call':67B,111C,219C 'carri':287C 'central':258C 'chosen':55B 'class':322C 'code':248C 'commit':398C 'complet':242C 'concept':216C 'control':196C 'core/meta':316C 'credit':400C 'cve':17A,25A 'cwe':29B,31B 'defeat':254C 'defin':330C 'deploy':266C 'detail':101C 'dispatch':51B,119C,121C,181C,286C,306C 'dynam':332C 'emb':104C 'equival':220C 'escap':3A,98C,244C 'eval':5A,70B,188C,192C,223C,348C 'evalu':189C 'exec':350C 'execut':74B,90C,224C,249C 'fix':302C,397C,403C 'forward':52B 'fulli':97C 'gem':41B,256C 'get':71B,354C 'ghsa':21A,393C 'ghsa-7pwq-q9jf-539h':20A,392C 'guarante':259C 'guest':4A,54B,66B,81C,109C,125C,169C,218C 'guest-chosen':53B 'guest-suppli':124C 'hafoudh':407C 'handl':333C 'host':7A,77B,95C,103C,200C,227C,234C,252C,378C 'impact':241C 'includ':162C 'influenc':273C 'insid':85C 'instanc':347C,349C,352C 'invok':158C 'isol':261C 'kernel':178C,319C 'kobako':1A,28A,33B,39B,87C 'kwarg':153C 'lead':245C 'method':10A,56B,127C,146C,161C,179C,184C,310C,325C,335C,342C,351C 'method.to':150C 'miss':11A,336C 'modifi':233C 'modul':317C,321C,360C 'mrubi':34B,44B,82C,263C 'name':57B,128C,297C 'none':365C 'object':64B,107C,131C,137C,143C,204C,320C,328C,380C 'otherwis':176C 'own':357C 'owner':313C 'packag':35B 'pass':122C 'patch':301C 'pivot':170C 'privat':177C 'process':78B,96C,228C,237C,253C 'proof':214C 'public':12A,59B,132C,155C,160C,173C,291C,345C 'q9jf':23A,395C 'rce':8A 'reach':6A 'reachabl':338C 'read':231C 'refer':391C 'reflect':166C,341C 'registri':298C 'reject':308C 'releas':278C 'remain':337C 'remot':247C 'report':401C 'request':182C 'requir':213C 'resolv':312C 'restrict':140C 'rpc':299C 'rubi':36B,40B,73B,92C,147C,163C,197C 'rubygem':37B 'run':42B,84C,193C,268C,385C 'sandbox':2A,48B,88C,100C,243C,383C 'script':45B,83C,110C,264C,274C,387C 'send':13A,60B,68B,133C,149C,156C,174C,185C,292C,343C,344C,346C 'servic':16A,63B,106C,203C,209C,379C 'service-specif':208C 'service.send':222C 'sink':293C 'spawn':236C 'specif':210C 'state':235C 'straight':129C 'success':296C 'suffici':206C 'summari':79C 'suppli':126C 'surfac':167C 'sym':151C 'target.public':148C 'target.send':191C 'three':295C 'transport':118C,300C 'unguard':290C 'untrust':43B,262C,269C,386C 'upgrad':373C,388C 'variabl':353C 'version':279C,369C 'via':9A,334C 'vulner':284C 'wasm':114C 'whose':311C 'within':366C 'workaround':364C","nicknames":[],"mitigations":[],"who_affected":"Any application that embeds the kobako gem and runs untrusted or attacker-influenced mruby scripts inside its sandbox, with host Service objects bound, is exposed in every release from 0.1.0 through 0.9.0. Applications that only run trusted scripts, or that bind no Service objects, are not reached by this flaw as described.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-18T20:09:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7pwq-q9jf-539h","url":"https://github.com/advisories/GHSA-7pwq-q9jf-539h","severity":"critical","published_at":"2026-08-18T20:09:59+00:00","modified_at":"2026-10-26T14:45:09+00:00","first_seen_at":"2026-10-26T14:47:19+00:00","fetched_at":"2026-10-26T14:52:20+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-55107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55107","severity":null,"published_at":"2026-09-30T18:18:37+00:00","modified_at":"2026-09-30T20:17:32+00:00","first_seen_at":"2026-10-26T15:00:59+00:00","fetched_at":"2026-10-26T15:00:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}