New rails-mcp-server advisory

gems/rails-mcp-server/CVE-2026-81097.yml

@@ -0,0 +1,44 @@
+---
+gem: rails-mcp-server
+cve: 2026-81097
+ghsa: 247c-497m-jx82
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-81097
+title: The execute_ruby tool is documented as a read-only Ruby sandbox
+date: 2026-08-27
+description: |
+  The execute_ruby tool is documented as a read-only Ruby sandbox
+  and is enforced by a pattern denylist together with replacements
+  for the process-spawning methods on Kernel.
+
+  The pseudo-terminal library's spawn entry points are neither in the
+  denylist nor replaced, so a normal tool call could reach them and
+  start a shell, executing commands as the account running the server
+  and outside  the guarded methods.
+
+  The denylist was introduced with the tool in 1.4.0 and
+  never covered those entry points through 1.6.0.
+
+  Version 1.6.1 restricts the requires the sandbox permits to a
+  data-only list and blocks dynamic dispatch to execution entry
+  points.
+
+  2.0.0 removes the tool.
+cvss_v3: 8.4
+cvss_v4: 8.6
+unaffected_versions:
+  - "< 1.4.0"
+patched_versions:
+  - ">= 1.6.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-81097
+
+    - https://rubygems.org/gems/rails-mcp-server/versions/2.0.0
+    - https://github.com/maquina-app/rails-mcp-server/releases/tag/v2.0.0
+    - https://rubygems.org/gems/rails-mcp-server/versions/1.6.1
+    - https://github.com/maquina-app/rails-mcp-server/releases/tag/v1.6.1
+    - https://github.com/maquina-app/rails-mcp-server/pull/59
+    - https://www.vulncheck.com/advisories/rails-mcp-server-1.4.0-through-1.6.0-os-command-execution-via-execute-ruby-pty-escape
+    - https://github.com/advisories/GHSA-247c-497m-jx82
+notes: |
+  - cvss_v3 and cvss_v4 from nvd.nist.gov URL.