{"id":"CVE-2026-55107","title":"Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving …","summary":"Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving …","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-94","CWE-470"],"vendor":"elct9620","product":"kobako","affected":["kobako >= 0.1.0, < 0.9.1"],"patched":["kobako 0.9.1"],"published":"2026-09-30","updated":"2026-09-30","sourceUpdated":"2026-09-30T20:17:32.923","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55107","references":[{"url":"https://github.com/elct9620/kobako/commit/64f84700c81f44902bed9211318d5362f44987b3","label":"security-advisories@github.com"},{"url":"https://github.com/elct9620/kobako/releases/tag/v0.9.1","label":"security-advisories@github.com"},{"url":"https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h","label":"security-advisories@github.com"},{"url":"https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-7pwq-q9jf-539h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55107"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kobako/GHSA-7pwq-q9jf-539h.yml"}],"tags":["nvd","cve.org","exploit-available","ghsa","rubygems"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-30T19:48:55.982496Z"},"aliases":["GHSA-7pwq-q9jf-539h"],"ecosystem":"rubygems","ingestedAt":"2026-08-18T20:22:15.701Z","epss":0.00799,"epssPercentile":0.56352,"slug":"CVE-2026-55107","body":"## Overview\n\nKobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55107)\n\nAffected packages:\n\n- `kobako >= 0.1.0, <= 0.9.0`\n\nPatched in:\n\n- `kobako 0.9.1`\n\nSource: https://github.com/advisories/GHSA-7pwq-q9jf-539h","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":213962,"id":"CVE-2026-55107","ts":1790799893633,"field":"exploit_available","old":"false","new":"true"}]}