Ruby on Rails has just released patches for a critical vulnerability that could allow attackers to execute code remotely on affected servers. This vulnerability, tracked as CVE-2026-66066, affects applications built with Ruby on Rails and using the libvips library for image processing.
The issue arises from the way libvips handles file read and write operations, marking some of these actions as “unfuzzed” – a term that may sound technical but essentially means they’re unsafe when dealing with untrusted content. In Ruby on Rails’ default configuration, Active Storage doesn’t disable these unfuzzed operations, creating an opportunity for attackers to exploit the vulnerability.
Here’s how it works: an attacker can upload a specially crafted file to the affected application, which will then allow them to read arbitrary files from the server. These files could include sensitive information like secret keys and credentials for external systems. An attacker with access to these secrets could escalate their attack to remote code execution (RCE), essentially giving them full control over the compromised system.
The vulnerability affects applications that use Active Storage, which is a part of Ruby on Rails used for image processing. Specifically, it impacts versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 of Active Storage. The patches are available now, but users need to update their deployments as soon as possible – in addition to updating libvips to at least version 8.13.
It’s worth noting that while the vulnerability has been patched, if an attacker was able to exploit it before the patch was applied, they may still have access to sensitive information like secret keys. In this case, affected applications should treat every secret readable by the application process as potentially exposed and change it.
Fortunately, cybersecurity firm Rapid7 reports that there is currently no evidence of the vulnerability being exploited in the wild. This suggests that users who apply the patches promptly will be able to prevent potential attacks.
As a practical takeaway for readers, it’s essential to stay up-to-date with security patches and updates for software components like Ruby on Rails and libvips. Regularly monitoring vulnerabilities and applying patches as soon as they become available can help protect against exploitation of such critical flaws.
Source: SecurityWeek — 2026-08-01