# CVE-2026-107360: rubygem-safemode Jail allow-list bypass in compound assignment

Source: https://junglewise.ai/threats/cve-2026-107360-a-flaw-was-found-in-rubygem-safemode-compound-assignment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-107360 · Severity: critical · CVSS 9.6 · Published 2026-11-12

rubygem-safemode is a Ruby library used to sandbox template execution in applications like Foreman. An authenticated user with template-editing privileges can bypass the sandbox's security restrictions and invoke destructive methods (such as deleting hosts) or access sensitive object data that should be hidden, giving them far more power than their normal permissions allow.

Technologies: [safemode (RubyGems)](https://junglewise.ai/threats/technologies/safemode). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-107360 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107360 being exploited in the wild.

**How severe is CVE-2026-107360?** Critical severity, with a CVSS score of 9.6, published 12 November 2026.

**Which products and versions are affected?** safemode (RubyGems) <UNKNOWN>.

**Is there a fix for CVE-2026-107360?** No fixed version is recorded yet. Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107360 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107360?** Check whether you run safemode (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors.

## Technical details

The vulnerability is a sandbox escape in rubygem-safemode's Jail allow-list enforcement, triggered by compound assignment expressions (op-assign) in sandboxed Ruby code. These expressions bypass method-call mediation, allowing an authenticated template author to invoke no-argument methods on exposed objects without Jail filtering. An attacker gains access to destructive operations and non-allow-listed object state in the context of the sandboxed template renderer.

## Affected products

- rubygems safemode <UNKNOWN>

## Timeline

- 2026-11-12: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-107360](https://access.redhat.com/security/cve/CVE-2026-107360)

## Related threats

- [Moderate severity vulnerability that affects safemode](https://junglewise.ai/threats/moderate-severity-vulnerability-that-affects-safemode-f869807a)
- [High severity vulnerability that affects safemode](https://junglewise.ai/threats/high-severity-vulnerability-that-affects-safemode-df3fedba)
- [safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method](https://junglewise.ai/threats/cve-2016-3693-safemode-gem-allows-context-dependent-attackers-to-obtain)
- [Safemode Gem Has Incomplete List of Disallowed Inputs](https://junglewise.ai/threats/cve-2017-7540-safemode-gem-has-incomplete-list-of-disallowed-inputs)