Critical severity · published Sep 30, 2026
CVE-2026-55107
Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
10.0
CVSS
0.8%
EPSS
No
On KEV
Description
Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
kobako · elct9620
>= 0.1.0, < 0.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55107
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55107
x_refsource_CONFIRM
https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h
x_refsource_MISC
https://github.com/elct9620/kobako/commit/64f84700c81f44902bed9211318d5362f44987b3
x_refsource_MISC
https://github.com/elct9620/kobako/releases/tag/v0.9.1