Executive brief
Rails MCP Server is a Ruby tool that allows AI language models to interact with Rails applications for code analysis and development assistance. The execute_ruby component was documented as a read-only sandbox but could be escaped through unsecured pseudo-terminal library functions, allowing an attacker to execute arbitrary system commands with the privileges of the server process.
Technical details
The execute_ruby tool enforces a read-only sandbox using a pattern-based denylist and method replacements for process-spawning functions on Kernel. However, the pseudo-terminal (PTY) library's spawn entry points were neither in the denylist nor replaced, and PTY was not guarded from dynamic dispatch or requires. An attacker could call execute_ruby with Ruby code requiring the PTY library and invoking PTY.spawn() or PTY.getpty() to execute arbitrary shell commands outside the guarded methods, running with the server's account privileges. This vulnerability affected versions 1.4.0 through 1.6.0. Version 1.6.1 restricts requires to a data-only allowlist and blocks dynamic dispatch; version 2.0.0 removes the tool entirely.
Affected products
- maquina-app rails-mcp-server 1.4.0 through 1.6.0
Timeline
- 2026-08-27: disclosed
- 2026-08-04: patched: Fixed in version 1.6.1 with require allowlist; removed in 2.0.0