GHSA-7pwq-q9jf-539h: kobako (CVE-2026-55107)

Package	Ecosystem	Affected	Fixed in
kobako	RubyGems	>=0.1.0, <0.9.1	0.9.1

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

The kobako RubyGems package, versions 0.1.0 up to but not including 0.9.1, lets a guest mruby script running in the sandbox reach arbitrary Ruby execution in the host process. The guest can make a dispatch call that routes through public_send to the send method, which reaches private Kernel methods such as eval, and this works on any bound Service object. Upgrade to kobako 0.9.1, which blocks methods owned by core modules; no workaround is given in the source other than not binding host Service objects into sandboxes that run untrusted scripts.

Written 3 Nov 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
10.0	Critical	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	CNA (GitHub_M)

CISA KEV Not listed.
EPSS 0.0080, the 56th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

31 Oct 2026, 14:21 UTC First seen by agentprime
31 Oct 2026, 14:21 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.