Rails patches critical Active Storage flaw with RCE potential

A critical vulnerability in the Active Storage component of Ruby on Rails could allow unauthenticated attackers to read arbitrary files and potentially execute code remotely. Identified as CVE-2026-66066, the flaw affects versions prior to 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. The issue arises when using the libvips library for image processing, especially if untrusted users can upload images. Attackers may exploit it to access sensitive data like secret keys and credentials. Developers are urged to update their dependencies and rotate secrets as recommended by the Rails team.