CVE-2026-107360
Awaiting Analysis Awaiting Analysis - Queue

Arbitrary Method Execution in RubyGems SafeMode

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: redhat-SADP

Description
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-107360
EUVD
EUVD-2026-124669

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Satellite 6 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-183 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the rubygem-safemode gem. It allows bypassing security restrictions in sandboxed template code by using compound assignment expressions like x.foo += v. These expressions execute methods directly on real objects without going through the intended Jail allow-list, enabling attackers to call destructive methods such as host deletion or access restricted object state.

Detection Guidance

Check for unauthorized template modifications or suspicious method calls in logs. Review Ruby on Rails application logs for compound assignment expressions like op_asgn2 or op_asgn1 in sandboxed template code. Inspect Foreman/Satellite template edit history for untrusted user activity.

Impact Analysis

An authenticated attacker with template editing privileges could delete hosts, modify data, or access sensitive information by exploiting this flaw. The impact includes potential data loss, unauthorized changes, and exposure of confidential details.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality requirements and HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Restrict template editing permissions to trusted administrators only. Avoid exposing privileged ActiveRecord objects to untrusted template authors. Update rubygem-safemode to the latest patched version if available. Monitor for unauthorized host deletions or data disclosures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107360. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...