Execute_ruby (1.4.0 to 1.6.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/execute_ruby-1.4.0-to-1.6.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 27 Aug 2026 19:10:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSandbox Escape in execute_ruby Toolhttps://feed.craftedsignal.io/briefs/2026-08-ruby-sandbox-bypass/Thu, 27 Aug 2026 19:10:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-ruby-sandbox-bypass/The execute_ruby tool fails to sanitize the pseudo-terminal library, allowing attackers to escape the Ruby sandbox and execute arbitrary system commands via spawn entry points.The execute_ruby tool, designed as a read-only Ruby sandbox, contains a critical security vulnerability (CVE-2026-81097) in versions 1.4.0 through 1.6.0. The sandbox relies on a pattern-based denylist and method overriding for Kernel process-spawning functions to maintain isolation. However, the pseudo-terminal library's spawn entry points were entirely omitted from these security controls. An attacker capable of triggering a tool call can reach these unprotected entry points to spawn a shell, effectively bypassing the read-only constraints and executing arbitrary commands with the privileges of the server process. This flaw represents a significant risk for any application providing user-controlled Ruby execution environments. The vulnerability is addressed in version 1.6.1, which limits allowed requires to a data-only list and blocks dynamic dispatch to execution methods, while version 2.0.0 removes the tool entirely.

Impact

Successful exploitation allows for full command execution on the host server. This bypasses the intended read-only sandbox restrictions, potentially leading to unauthorized data access, persistence, or lateral movement within the environment where the server process resides.

Recommendation

  • Upgrade the execute_ruby tool to version 1.6.1 or later immediately.
  • If upgrading is not immediately feasible, remove the execute_ruby tool entirely (version 2.0.0 removal).
  • Review application logs for unauthorized execution of PTY-related Ruby modules that fall outside the intended business logic scope.
]]>highadvisory