Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81097— rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape

Quick assessment

Affected
maquina-app rails-mcp-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

工具被文档描述为只读 Ruby 沙箱，并通过一个基于模式的拒绝列表（denylist）以及对 进程中方法（如进程创建方法）的替换来进行强制约束。然而，伪终端（pseudo-terminal）库的 入口点既不在拒绝列表中，也未被替换。因此，一次普通的工具调用可以触达这些入口点，从而启动 shell，并以运行服务器的账户身份执行命令，且这些操作发生在受保护方法之外。 该拒绝列表自 1.4.0 版本随工具一起引入，但直至 1.6.0 版本都未涵盖上述入口点。在 1.6.1 版本中，沙箱所允许的 语句被限制为纯数据列表，并

CVSS 8.4 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
maquina-app rails-mcp-server 1.4.0≤ 1.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81097

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
Source: CVE Program / CVE List V5
Vulnerability Description
The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded methods. The denylist was introduced with the tool in 1.4.0 and never covered those entry points through 1.6.0. Version 1.6.1 restricts the requires the sandbox permits to a data-only list and blocks dynamic dispatch to execution entry points; 2.0.0 removes the tool.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
maquina-app rails-mcp-server 1.4.0 ~ 1.6.0 -

II. Public POCs for CVE-2026-81097

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81097

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81097 (1)

Vendor Advisories for CVE-2026-81097 (1)

Vendor Pages for CVE-2026-81097 (1)

IV. Related Vulnerabilities

Same weakness: CWE-78

V. Comments for CVE-2026-81097

No comments yet

Leave a comment