critical vulnerability

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Fix availableCritical · CVSS 10EPSS 0.80%

Published Aug 18, 2026 · updated Oct 26, 2026

What to do

Upgrade to a fixed version: kobako 0.9.1.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

RubyGemskobako

Vulnerable versions: >= 0.1.0, <= 0.9.0
Fixed in: 0.9.1

Check your project: bundle info kobako

Sources

GitHub Advisory GHSA-7pwq-q9jf-539h
NVD CVE-2026-55107

CWE-94 Improper Control of Generation of Code ('Code Injection') · CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

← All critical vulnerabilities