A Critical Ruby on Rails Vulnerability is Now Being Exploited by Attackers
A severe vulnerability in Ruby on Rails, a popular web application framework, has been exploited by attackers. The flaw, known as KindaRails2Shell, allows an unauthenticated attacker to execute arbitrary code remotely, potentially leading to data breaches and lateral movement within a network. This vulnerability is particularly concerning because it was disclosed just last month, and patches were released immediately.
The issue lies in the way that Ruby on Rails uses different libraries to process images uploaded from users. Specifically, the libvips library, which is used for Active Storage image processing, can be tricked into loading an arbitrary file as if it were an image. This allows an attacker to read sensitive files, such as credential databases and storage keys, which can then be used to forge sessions and execute arbitrary code remotely.
VulnCheck, a security research firm, has warned that attackers began exploiting the vulnerability last week, just one month after patches were released. This is particularly alarming because it suggests that attackers may have had access to vulnerable systems for some time before the patch was applied. According to VulnCheck, around 7,000 Ruby on Rails instances are currently exposed to this vulnerability.
The technical details of the vulnerability are complex, but essentially, an attacker can craft a file that is declared as a MATLAB Level 5 image. The libvips library will then attempt to load the file as if it were an image, but in reality, it will be reading an arbitrary file from the server. This file can contain sensitive information or even malicious code that will execute remotely.
The vulnerability has been extensively documented by security researchers, who have released technical information and proof-of-concept code targeting the flaw. Ruby on Rails has also provided forensic tools to help detect exploitation attempts.
What makes this vulnerability particularly concerning is its potential for lateral movement within a network. If an attacker gains access to a vulnerable system, they can potentially move laterally through the network, accessing other systems and data without being detected.
If you use Ruby on Rails in your applications, it’s essential to apply the patches as soon as possible to prevent exploitation. Additionally, it’s crucial to ensure that all uploaded files are properly sanitized and validated to prevent similar attacks in the future.
Source: SecurityWeek — 2026-08-31