Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-55107: Kobako gem lets sandbox code break out
CVE-2026-55107 · published 18 days ago
Summary
The Kobako Ruby library (versions before 0.9.1) can let malicious Ruby code run inside its sandbox escape and execute anything on the main application. This means an attacker could take control of the server hosting the application. Update Kobako to version 0.9.1 or later to close the risk.
What to do
- Update aotokitsuruya kobako to version 0.9.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | aotokitsuruya | kobako |
>= 0.1.0, <= 0.9.0 Fix: upgrade to 0.9.1
|
| – | elct9620 | kobako | >= 0.1.0, < 0.9.1 |
Original advisory text
Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-94Code Injection
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Timeline
Published30 Sep 2026
Updated15 Oct 2026
First seen18 Aug 2026
Track software like this
Free during beta