Ruby Safemode Gem Remote Method Invocation via Compound Assignment
CVE-2026-107360 Published on November 12, 2026
Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
Vulnerability Analysis
CVE-2026-107360 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 41 days later.
Weakness Type
What is an Allowlist / Allow List Vulnerability?
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
CVE-2026-107360 has been classified to as an Allowlist / Allow List vulnerability or weakness.
Products Associated with CVE-2026-107360
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
