From b78737e8638412171fa996aac9c88cc47988a8ef Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Wed, 19 Aug 2026 12:11:35 -0400
Subject: [PATCH 1/2] One new kobako gem advisory

---
 gems/kobako/GHSA-7pwq-q9jf-539h.yml | 48 +++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 gems/kobako/GHSA-7pwq-q9jf-539h.yml

diff --git a/gems/kobako/GHSA-7pwq-q9jf-539h.yml b/gems/kobako/GHSA-7pwq-q9jf-539h.yml
new file mode 100644
index 0000000000..75b5759390
--- /dev/null
+++ b/gems/kobako/GHSA-7pwq-q9jf-539h.yml
@@ -0,0 +1,48 @@
+---
+gem: kobako
+cve: 2026-55107
+ghsa: 7pwq-q9jf-539h
+url: https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h
+title: kobako Sandbox Escape - guest eval reaches host RCE via
+  method_missing → public_send (any bound Service)
+date: 2026-08-18
+description: |
+  ### Summary
+
+  A guest mruby script running inside the Kobako sandbox can execute
+  arbitrary Ruby in the host process, fully escaping the sandbox.
+
+  ### Impact
+
+  Complete sandbox escape leading to remote code execution in the host process,
+  defeating the gem's central guarantee of isolating untrusted mruby scripts.
+  Any deployment that runs untrusted or attacker-influenced scripts is affected.
+  All released versions (0.1.0 through 0.9.0) are vulnerable; the dispatcher
+  carried the same unguarded `public_send` sink under three successive names
+  (`registry` → `rpc` → `transport`).
+
+  ### Credits
+
+  Reported and fixed by Ahmed Al Hafoudh.
+cvss_v3: 10.0
+patched_versions:
+  - ">= 0.9.1"
+related:
+  url:
+    - https://rubygems.org/gems/kobako/versions/0.22.0
+    - https://github.com/elct9620/kobako/releases/tag/v0.22.0
+    - https://github.com/elct9620/kobako/commit/64f84700c81f44902bed9211318d5362f44987b3
+    - https://advisories.gitlab.com/gem/kobako/CVE-2026-55107
+    - https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h
+    - https://github.com/advisories/GHSA-7pwq-q9jf-539h
+notes: |
+  - cvss_v3 from GHSA
+  - CVE is reserved, but not published.
+  - Details on Patch:
+    - Fixed in 0.9.1. The dispatcher now rejects any method whose resolved
+      owner is a core/meta module (`BasicObject`, `Kernel`, `Object`,
+      `Module`, `Class`), so only methods the bound object itself defines —
+      or dynamically handles via `method_missing` — remain reachable.
+      The ambient reflection methods (`send`, `__send__`, `public_send`,
+      `instance_eval`, `instance_exec`, `method`, `instance_variable_get`,
+      …) are all owned by those modules and are blocked.

From ce7301ce9d8bcd40cb26120bafa1e7d0773a64be Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Wed, 19 Aug 2026 19:08:58 -0400
Subject: [PATCH 2/2] Update related URLs in GHSA-7pwq-q9jf-539h.yml

---
 gems/kobako/GHSA-7pwq-q9jf-539h.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/gems/kobako/GHSA-7pwq-q9jf-539h.yml b/gems/kobako/GHSA-7pwq-q9jf-539h.yml
index 75b5759390..3df887ccae 100644
--- a/gems/kobako/GHSA-7pwq-q9jf-539h.yml
+++ b/gems/kobako/GHSA-7pwq-q9jf-539h.yml
@@ -29,8 +29,9 @@ patched_versions:
   - ">= 0.9.1"
 related:
   url:
-    - https://rubygems.org/gems/kobako/versions/0.22.0
-    - https://github.com/elct9620/kobako/releases/tag/v0.22.0
+    - https://rubygems.org/gems/kobako/versions/0.9.1
+    - https://github.com/elct9620/kobako/blob/main/CHANGELOG.md#091-2026-06-11
+    - https://github.com/elct9620/kobako/commit/dd081665f368f7ba54e476c3ad045ee1aa8ed703
     - https://github.com/elct9620/kobako/commit/64f84700c81f44902bed9211318d5362f44987b3
     - https://advisories.gitlab.com/gem/kobako/CVE-2026-55107
     - https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h