CVE-2026-55107

Name of the Vulnerable Software and Affected Versions Kobako versions 0.1.0 through 0.9.0

Description A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby code in the host process, resulting in a complete sandbox escape. The issue occurs because the transport dispatcher passes guest-supplied method names directly to Object#public send on bound Service objects without restricting them to the object's own methods. An attacker can use the public send method to pivot into private Kernel methods, such as by passing method = "send" and args = [:eval, "<ruby>"], which allows the execution of attacker-controlled Ruby code in the host process. This enables the attacker to read or modify host state and spawn processes.

Recommendations Update Kobako to version 0.9.1. As a temporary mitigation, do not bind any host Service object into a sandbox that runs untrusted scripts.