CVE-2026-81097: rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded methods. The denylist was introduced with the tool in 1.4.0 and never covered those entry points through 1.6.0. Version 1.6.1 restricts the requires the sandbox permits to a data-only list and blocks dynamic dispatch to execution entry points; 2.0.0 removes the tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rails-mcp-serverto a version that resolves this vulnerability.Fixed in 1.6.1 - Upgrade
Upgrade
rails-mcp-serverto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to make a normal execute_ruby tool call to a vulnerable rails-mcp-server instance. No authentication or user interaction is required according to the supplied vector, but exploitation is local (AV:L).
Which deployments are affected?
rails-mcp-server versions 1.4.0 through 1.6.0 are affected. The vulnerable behavior is part of the execute_ruby tool's sandbox enforcement, so deployments that expose or permit use of that tool are exposed.
What is the impact of successful exploitation?
A successful exploit can start a shell and execute operating-system commands as the account running the rails-mcp-server process. This can compromise confidentiality, integrity, and availability of resources accessible to that account.
What versions address the issue?
Version 1.6.1 restricts sandbox-permitted requires to a data-only list and blocks dynamic dispatch to execution entry points. Version 2.0.0 removes the execute_ruby tool.