CVE-2026-55107: CWE-94: Improper Control of Generation of Code ('Code Injection') in elct9620 kobako
Kobako is a Ruby gem embedding a Wasm-isolated mruby interpreter to safely run untrusted Ruby scripts. Versions from 0.1.0 up to but not including 0.9.1 contain a critical vulnerability allowing guest scripts to escape the sandbox and execute arbitrary Ruby code in the host process. This vulnerability, classified as CWE-94 (Improper Control of Generation of Code), has been fixed in version 0.9.1.
AI Analysis
Technical Summary
CVE-2026-55107 describes a critical code injection vulnerability in the Kobako Ruby gem, which embeds a Wasm-isolated mruby interpreter for executing untrusted Ruby scripts in a sandboxed environment. In versions >=0.1.0 and <0.9.1, a guest mruby script can escape the sandbox and execute arbitrary Ruby code in the host process, fully compromising the isolation. This flaw allows an attacker to bypass the intended memory, file, network, and credential protections. The issue has been patched in version 0.9.1.
Potential Impact
Successful exploitation allows arbitrary code execution in the host process, resulting in complete sandbox escape. This leads to full compromise of the host application, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 10.0 (critical).
Mitigation Recommendations
Upgrade Kobako to version 0.9.1 or later, where this vulnerability is patched. No other mitigation is required as the fix fully addresses the issue.
CVE-2026-55107: CWE-94: Improper Control of Generation of Code ('Code Injection') in elct9620 kobako
Description
Kobako is a Ruby gem embedding a Wasm-isolated mruby interpreter to safely run untrusted Ruby scripts. Versions from 0.1.0 up to but not including 0.9.1 contain a critical vulnerability allowing guest scripts to escape the sandbox and execute arbitrary Ruby code in the host process. This vulnerability, classified as CWE-94 (Improper Control of Generation of Code), has been fixed in version 0.9.1.
CVSS v3.1
Score 10.0critical
Affected software
elct9620
kobako
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55107 describes a critical code injection vulnerability in the Kobako Ruby gem, which embeds a Wasm-isolated mruby interpreter for executing untrusted Ruby scripts in a sandboxed environment. In versions >=0.1.0 and <0.9.1, a guest mruby script can escape the sandbox and execute arbitrary Ruby code in the host process, fully compromising the isolation. This flaw allows an attacker to bypass the intended memory, file, network, and credential protections. The issue has been patched in version 0.9.1.
Potential Impact
Successful exploitation allows arbitrary code execution in the host process, resulting in complete sandbox escape. This leads to full compromise of the host application, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 10.0 (critical).
Mitigation Recommendations
Upgrade Kobako to version 0.9.1 or later, where this vulnerability is patched. No other mitigation is required as the fix fully addresses the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T14:41:54.579Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abd6b1e2a4e24523d869f96
Added to database: 09/30/2026, 20:03:42 UTC
Last enriched: 09/30/2026, 20:18:03 UTC
Last updated: 10/01/2026, 04:35:53 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.