CVE-2026-81097: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in maquina-app rails-mcp-server

The execute_ruby tool in maquina-app rails-mcp-server versions 1.4.0 through 1.6.0 is designed as a read-only Ruby sandbox enforced by a denylist and method replacements to prevent process spawning. However, the pseudo-terminal library's spawn entry points are not included in the denylist or replaced, enabling normal tool calls to reach them and spawn a shell. This allows execution of arbitrary OS commands with the privileges of the server process. The denylist was introduced in version 1.4.0 but did not cover these entry points through 1.6.0. Version 1.6.1 restricts the sandbox's permitted requires to a data-only list and blocks dynamic dispatch to execution entry points, mitigating the issue. Version 2.0.0 removes the execute_ruby tool entirely, eliminating the vulnerability.

An attacker able to invoke the execute_ruby tool in affected versions can execute arbitrary OS commands with the privileges of the rails-mcp-server process. This can lead to unauthorized command execution and potential full compromise of the server environment. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity with local attack vector, low attack complexity, no privileges or user interaction required, but high impact on confidentiality, integrity, and availability.

No official patch or remediation level is stated in the available data. However, versions 1.6.1 and later include mitigations by restricting the sandbox's permitted requires and blocking dynamic dispatch to execution entry points, and version 2.0.0 removes the vulnerable execute_ruby tool entirely. Users should upgrade to at least version 1.6.1 to benefit from these mitigations or to version 2.0.0 to remove the vulnerable component. Patch status is not yet confirmed by a vendor advisory; check the vendor's official guidance for current remediation.