Executive brief
Kobako is a Ruby gem that sandboxes untrusted mruby scripts by isolating them in a WebAssembly environment. A critical flaw allows guest scripts to execute arbitrary Ruby code in the host process, completely defeating the sandbox isolation. An attacker can read or modify any host data, spawn processes, and take full control of the host application.
Technical details
The vulnerability is a code injection flaw (CWE-94) combined with unsafe reflection (CWE-470). When guest scripts call methods on host-bound Service objects via the transport dispatcher, the dispatcher passes the guest-supplied method name directly to Ruby's `Object#public_send` without validation: `target.public_send(method.to_sym, *args, **kwargs, &block)`. This allows a guest to invoke any public method, including Ruby's ambient reflection methods. By requesting `method = "send"` with `args = [:eval, "<ruby>"]`, the guest achieves `target.send(:eval, "<ruby>")`, executing arbitrary host Ruby in the host process. No Service-specific behavior or authentication is required; any bound Service object enables the escape. The vulnerable code existed in versions 0.1.0 through 0.9.0 under three different names (`registry`, `rpc`, `transport`). Fixed in 0.9.1 by rejecting methods owned by core/meta modules (BasicObject, Kernel, Object, Module, Class), blocking all reflection entry points.
Affected products
- elct9620 kobako 0.1.0 to 0.9.0
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: Fixed in version 0.9.1