AIKIDO-2026-805701

TL;DR

The Ruby extension establishes the MySQL connection socket in Ruby and duplicates the underlying file descriptor with dup in contrib/ruby/ext/trilogy-ruby/cext.c before handing it to trilogy_connect_set_fd. The duplicated descriptor did not inherit the FD_CLOEXEC flag, so the live authenticated database socket stayed open across exec. Any child process spawned by the application while a Trilogy connection is open inherited that descriptor and could read from or write to the database connection. The fix reads the original descriptor flags with fcntl(F_GETFD) and reapplies them to the new descriptor with fcntl(F_SETFD) so the socket is closed on exec.