CRITICAL 10.0 GitHub
CVE-2026-55107
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
### Summary
A guest mruby script running inside the Kobako sandbox can execute arbitrary
Ruby in the host process, fully escaping the sandbox.
### Details
A host embeds bound "Service" objects that guest scripts call across the wasm
boundary through the transport dispatcher. The dispatcher passed the
guest-supplied method name straight to `Object#public_send` on the bound
object, with no restriction to the object's own methods:
```ruby
target.public_send(method.to_sym, *args, **kwargs, &block)
Affected Products
- rubygems/kobako >= 0.1.0, <= 0.9.0
References
- https://github.com/advisories/GHSA-7pwq-q9jf-539h
- https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h
- https://github.com/elct9620/kobako/commit/64f84700c81f44902bed9211318d5362f44987b3
- https://github.com/advisories/GHSA-7pwq-q9jf-539h
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-08-18 via GitHub. Affected: rubygems/kobako >= 0.1.0, <= 0.9.0.
Risk Timeline
CVE Disclosed2026-08-18 · -1 days ago
Remediation Resources
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.