{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-safemode","product":"Red Hat Satellite 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-107360","cwes":["CWE-183"],"description":"A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.6,"severity":"critical","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794513853447,"publishedAt":1794513853447,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-107360"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547645"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors."}],"revision":"91f456f565652022252497a2b302e8bab34f16ed7e7812bb9181a4e5f6a82c5f","sources":[{"modifiedAt":1794513853447,"name":"CNA: redhat","retrievedAt":1794517707797,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107360"}],"ssvc":null,"status":"published","title":"Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions","updatedAt":1794517707797}