The execute_ruby tool is intended to run in a read‑only Ruby sandbox, enforcing a denylist of disallowed patterns and replacing process‑spawning methods in Kernel. However, the pseudo‑terminal library’s spawn functions are not included in the denylist or replaced, so a normal call can reach them and launch a shell. This permits an attacker to execute arbitrary commands with the privileges of the server process, compromising confidentiality, integrity, and availability of the entire system.

The affected product is the Rails micro‑control‑protocol server (rails‑mcp‑server) from maquina‑app. Versions 1.4.0 through 1.6.0 are vulnerable. Version 1.6.1 adds a data‑only whitelist and blocks dynamic dispatch to execution entry points, and 2.0.0 removes the execute_ruby tool entirely.

The CVSS score of 8.6 classifies this as a high‑severity flaw. EPSS is not available and the vulnerability is not listed in the KEV catalog, so current exploitation probability is unclear. The flaw can be triggered by a normal call to execute_ruby, enabling an attacker to spawn a shell and run arbitrary commands. The attack requires no special privileges beyond those of the server process, making the risk significant until mitigation actions are taken.