critical · 10CVE-2026-55107Aug 18, 2026

CVE-2026-55107: kobako Sandbox Escape via Unguarded public_send Dispatcher

Rohit Hatagale
AI Security Researcher, SecureLayer7

A guest mruby script running inside a kobako sandbox can call any Ruby method on the host process, including eval, by pivoting through the dispatcher's unguarded public_send call to reach Kernel…

Packagekobako
Ecosystemrubygems
Affected>= 0.1.0, <= 0.9.0
Fixed in0.9.1
CVE-2026-55107: kobako Sandbox Escape via Unguarded public_send Dispatcher

The problem

kobako lets host applications embed bound Service objects that guest mruby scripts invoke across the Wasm boundary. The transport dispatcher passed the guest-supplied method name directly to Object#public_send on the bound Service, with no check that the method actually belongs to that Service.

Because public_send exposes the full ambient Ruby reflection surface, a guest can pass "send" as the method name and [:eval, "<ruby>"] as arguments. That resolves to target.send(:eval, "<ruby>"), executing attacker-controlled Ruby in the host process. Any bound Service object is sufficient; no Service-specific behavior is needed.

The flaw existed under three successive dispatcher names across all released versions (0.1.0 through 0.9.0).

Proof of concept

A working proof-of-concept for CVE-2026-55107 in kobako, with the exact payload below.

ruby
# Guest-side mruby script calling into the host dispatcher.
# The dispatcher routes this as: target.public_send(:send, :eval, payload)
# which evaluates to: target.send(:eval, payload) in the host Ruby process.

Service.send(:eval, "`id` + ' ' + `cat /etc/passwd`")

The root cause is an unsafe reflection sink: target.public_send(method.to_sym, *args, **kwargs, &block) with no allowlist. public_send is itself a public method, so passing method = "send" lets the guest reach Kernel#send, which in turn can call any private method including eval.

The patch in commit 64f8470 adds an owner-module check that rejects any method whose resolved owner is BasicObject, Kernel, Object, Module, or Class. This blocks the entire ambient reflection surface (send, __send__, public_send, instance_eval, instance_exec, method, instance_variable_get, and friends) while leaving Service-defined methods reachable.

CWE-94 (Code Injection) and CWE-470 (Unsafe Reflection) both apply.

The fix

Upgrade to kobako 0.9.1. The patched dispatcher validates that the resolved method owner is not a core Ruby module before dispatching. There is no workaround in affected versions; do not bind any host Service into a sandbox running untrusted scripts until you can upgrade.

Reported by Ahmed Al Hafoudh.

References: [1][2][3]

Related research