CVE-2026-55107: Code Injection
Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox.
Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the guest-supplied method name straight to Object#publicsend on the bound object, with no restriction to the object's own methods:
ruby target.publicsend(method.tosym, args, kwargs, &block)
publicsend can invoke any public method, including Ruby's ambient reflection surface. A guest pivots through the public send into otherwise private Kernel methods: a dispatch request with method = "send" and args = [:eval, "<ruby>"] evaluates to target.send(:eval, "<ruby>"), running attacker-controlled Ruby in the host. Any bound Service object is sufficient — no Service-specific behavior is required.
Proof of Concept A guest call equivalent to:
Service.send(:eval, "<arbitrary host ruby>")
executes in the host process and can read or modify host state, spawn processes, and so on.
Impact Complete sandbox escape leading to remote code execution in the host process, defeating the gem's central guarantee of isolating untrusted mruby scripts. Any deployment that runs untrusted or attacker-influenced scripts is affected. All released versions (0.1.0 through 0.9.0) are vulnerable; the dispatcher carried the same unguarded publicsend sink under three successive names (registry → rpc → transport).
Patches Fixed in 0.9.1. The dispatcher now rejects any method whose resolved owner is a core/meta module (BasicObject, Kernel, Object, Module, Class), so only methods the bound object itself defines — or dynamically handles via methodmissing — remain reachable. The ambient reflection methods (send, send, publicsend, instanceeval, instanceexec, method, instancevariableget, …) are all owned by those modules and are blocked.
Workarounds None within the affected versions. Until you can upgrade, do not bind any host Service object into a sandbox that runs untrusted scripts. Upgrade to 0.9.1.
References - GHSA-7pwq-q9jf-539h - Fix commit: 64f8470
Credits Reported and fixed by Ahmed Al Hafoudh.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/kobakoto a version that resolves this vulnerability.Fixed in 0.9.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.9.1Patch 64f8470 - Compensating control
Until you can upgrade to 0.9.1, do not bind any Service objects to untrusted or attacker-influenced guest mruby scripts (i.e., avoid embedding bound "Service" objects that guest scripts can call across the wasm transport dispatcher).
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications that embed Kobako and expose at least one bound Service object to guest mruby scripts are affected. The Service object does not need any particular application-specific behavior; any bound Service object provides the pivot.
What must an attacker be able to do to exploit this?
An attacker needs the ability to run or control a guest mruby script within the Kobako sandbox and access a bound Service object. No authentication, user interaction, or complex exploitation conditions are indicated by the supplied vector.
How does a sandboxed guest reach host-code execution?
The vulnerable dispatcher permits guest-controlled method names to reach public_send without restricting calls to methods defined by the Service object. A guest can invoke public send and use it to reach private Kernel methods such as eval, resulting in arbitrary Ruby execution in the host process.
What temporary mitigation is available?
If patching cannot happen immediately, avoid executing untrusted guest mruby scripts and avoid binding Service objects into guest-accessible sandbox contexts. Either condition prevents the described exploitation path from being available.