CVE-2026-55107

CriticalCVSS 10.0/10Last modified Sep 30, 2026

Description

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-470

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-551088.5KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1CVE-2026-55112.7In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in lCVE-2026-551106.1A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration CVE-2026-551117.5A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to accesCVE-2026-551128.8A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerCVE-2026-551137.5A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk ApplicatioCVE-2026-551148.8A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi NetworCVE-2026-551159.9A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect ApplicatCVE-2026-551169.8A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerabilityCVE-2026-551178.6A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files CVE-2026-551188.3A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerabilCVE-2026-551198.1A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk A
CVE-2026-55107: Critical severity, CVSS 10.0 | Vulnix