CVE-2026-55107CWE-470CWE-94code-injection

CVE-2026-55107

Critical · published September 30, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00799 · 56.1th percentile
Weaknesses
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-30T22:18Z
References (4)
https://github.com/elct9620/kobako/commit/64f84700c81f44902bed9211318d5362f44987b3 · [email protected]https://github.com/elct9620/kobako/releases/tag/v0.9.1 · [email protected]https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h · [email protected]https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 03:44Z
    EPSS moved — → 1%
    epss
  • 30 SEP 17:06Z
    Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
    cvelistv5