Quick answers
- Is CVE-2026-107360 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107360 being exploited in the wild.
- How severe is CVE-2026-107360?
- Critical severity, with a CVSS score of 9.6, published 12 November 2026.
- Which products and versions are affected?
- safemode (RubyGems) <UNKNOWN>.
- Is there a fix for CVE-2026-107360?
- No fixed version is recorded yet. Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-107360 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-107360?
- Check whether you run safemode (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors.
Technical details
The vulnerability is a sandbox escape in rubygem-safemode's Jail allow-list enforcement, triggered by compound assignment expressions (op-assign) in sandboxed Ruby code. These expressions bypass method-call mediation, allowing an authenticated template author to invoke no-argument methods on exposed objects without Jail filtering. An attacker gains access to destructive operations and non-allow-listed object state in the context of the sandboxed template renderer.
Affected products
- rubygems safemode <UNKNOWN>
Timeline
- 2026-11-12: disclosed