---
id: CVE-2026-107360
title: 'Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions'
summary: >-
  A flaw was found in rubygem-safemode. Compound assignment expressions in
  sandboxed code are evaluated without mediating method calls through the Jail
  allow-list. An authenticated attacker who can supply template content can
  invoke arbitr…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-183
vendor: Red Hat
product: rubygem-safemode
affected:
  - rubygem-safemode (all versions)
  - rubygem-safemode (all versions)
  - rubygem-safemode (all versions)
  - rubygem-safemode (all versions)
  - rubygem-safemode (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-13T15:34:51.731568Z'
exploitAvailable: true
published: '2026-11-12'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T16:58:25.857Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107360'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:100120'
    label: 'RHSA-2026:100120'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99949'
    label: 'RHSA-2026:99949'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99950'
    label: 'RHSA-2026:99950'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99952'
    label: 'RHSA-2026:99952'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-107360'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2547645'
    label: RHBZ#2547645
tags:
  - cve.org
  - exploit-available
epss: 0.00512
epssPercentile: 0.4428
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/googlesky/CVE-2026-107360'
  checkedAt: '2026-11-15T00:50:52.498Z'
ingestedAt: '2026-11-12T20:54:37.331Z'
---

## Overview

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.

## Affected

- `rubygem-safemode (all versions)`
- `rubygem-safemode (all versions)`
- `rubygem-safemode (all versions)`
- `rubygem-safemode (all versions)`
- `rubygem-safemode (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors.