{"id":"CVE-2026-107360","aliases":[],"cve":{"records":[{"id":"CVE-2026-107360","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-07T20:07:22.060Z","published":"2026-11-12T20:04:13.447Z","modified":"2026-11-13T16:58:25.857Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-13T16:58:25.857Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T16:27:43.464Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:100120","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:99949","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:99950","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:99952","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-107360","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547645","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-183","description":"Permissive List of Allowed Inputs","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T15:34:51.731568Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.","score":9.6,"severity":"critical","published":"2026-11-12T20:04:13.447Z","modified":"2026-11-13T16:58:25.857Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Satellite 6.16 for RHEL 8","platforms":[],"versions":[{"version":"0:1.5.0-3.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.16 for RHEL 9","platforms":[],"versions":[{"version":"0:1.5.0-3.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:1.5.0-3.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.18 for RHEL 9","platforms":[],"versions":[{"version":"0:1.5.0-3.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.19 for RHEL 9","platforms":[],"versions":[{"version":"0:1.5.0-3.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"}],"remediation":[{"text":"Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"}],"references":["https://access.redhat.com/errata/RHSA-2026:100120","https://access.redhat.com/errata/RHSA-2026:99949","https://access.redhat.com/errata/RHSA-2026:99950","https://access.redhat.com/errata/RHSA-2026:99952","https://access.redhat.com/security/cve/CVE-2026-107360","https://bugzilla.redhat.com/show_bug.cgi?id=2547645"],"sources":[{"name":"CVE","id":"CVE-2026-107360","modified":"2026-11-13T16:58:25.857Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":9.6}],"sourceAffected":[],"observedAt":"2026-11-13T17:40:25.291Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T00:35:36.875Z","attemptedAt":"2026-11-13T00:35:36.875Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T00:35:36.864Z","attemptedAt":"2026-11-13T00:35:36.864Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T00:35:36.575Z","attemptedAt":"2026-11-13T00:35:36.575Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T00:35:36.344Z","attemptedAt":"2026-11-13T00:35:36.344Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-124669","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124669","modified":"Nov 12, 2026, 8:04:13 PM","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-13T00:35:36.575Z"},{"source":"GitHub Advisory Database","id":"GHSA-xrw4-g928-4w5v","url":"https://github.com/advisories/GHSA-xrw4-g928-4w5v","modified":"2026-11-13T00:33:00Z","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-13T00:35:36.864Z"},{"source":"NVD","id":"CVE-2026-107360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107360","modified":"2026-11-13T00:20:06.967","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-13T00:35:36.875Z"}],"aiSummary":{"text":"A flaw in rubygem-safemode allows an authenticated attacker to invoke arbitrary methods on exposed objects without mediation. The attacker must be able to supply template content. The impact includes destructive operations and disclosure of object state.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T17:41:11.482Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"}]}}