CVE-2026-55107

10.0 Critique

Publiée le 30/09/2026 à 20:18 · Modifiée le 30/09/2026 à 22:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.

Traduire en français

Produits concernés

elct9620 kobako

Scores CVSS

Version	Score	Source	Vecteur
3.1	10.0 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94
CWE-470

Références

https://github.com/elct9620/kobako/commit/64f84700c81f44902bed9211318d5362f44987b3
https://github.com/elct9620/kobako/releases/tag/v0.9.1
https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h
https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories