kobako Sandbox Escape Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- kobako (gem)
- Affected versions
- >= 0.1.0, < 0.9.1 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.2, <= 0.1.2 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.5.0, <= 0.5.0 or >= 0.6.0, <= 0.6.0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.7.0, <= 0.7.0 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0
- Patched version
- 0.9.1
An early warning has been issued for a high-severity sandbox escape vulnerability in the kobako gem. Versions >= 0.1.0, < 0.9.1 are reportedly affected.
What happened
An early warning has been issued regarding a high-severity vulnerability in the kobako gem. The vulnerability, tracked as GHSA-7PWQ-Q9JF-539H, allows a guest mruby script running inside the Kobako sandbox to execute arbitrary Ruby code in the host process, fully escaping the sandbox. This is achieved through the method_missing → public_send mechanism in any bound Service. The vulnerability has not been exploited in the wild as of the latest reports.
The affected versions of the kobako gem range from >= 0.1.0 to < 0.9.1. Users of these versions are advised to take immediate action to mitigate potential risks.
What to do about it
- Upgrade to kobako@0.9.1 to mitigate the sandbox escape vulnerability.
- Review your application's use of the kobako gem and ensure that all instances are updated to the patched version.
- Monitor the primary sources for any updates or additional information regarding this vulnerability.
How 0Day would have caught this
kobako is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using kobako gem versions >= 0.1.0, < 0.9.1, you are reportedly affected by this vulnerability.
What should I do right now?
Immediately upgrade to kobako@0.9.1 to mitigate the vulnerability.
Has this been exploited in the wild?
No, the vulnerability has not been reported as exploited in the wild.