В Ruby on Rails устранили критическую RCE-уязвимость

{
  "title": "Critical RCE Fixed in Ruby on Rails",
  "seo_title": "Ruby on Rails Patched: CVE-2026-66066",
  "seo_description": "Patch released: Ruby on Rails 7.0–8.1.3 affected by critical RCE via Active Storage. Update to 7.2.3.2, 8.0.5.1 or 8.1.3.1.",
  "body_md": "Developers of Ruby on Rails have addressed a critical remote code execution (RCE) flaw in Active Storage that could allow unauthenticated attackers to upload specially crafted images and read arbitrary files accessible to the application process. The vulnerability, tracked as [CVE-2026-66066](https://nvd.nist.gov/vuln/detail/CVE-2026-66066) with a CVSS score of 9.5, also enabled potential exploitation for RCE attacks. It was independently discovered by researchers from Ethiack and GMO Flatt Security.

The issue affects applications using the `libvips` library for image processing through Active Storage and accepting uploads from untrusted users. Vulnerable versions include Ruby on Rails 7.0.0–7.2.3.1, 8.0.0–8.0.5, and 8.1.0–8.1.3. Additionally, Rails 6.x is vulnerable if Vips is manually configured as the image processor.

Patches are available in Ruby on Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. Users must also update to libvips 8.13 or newer and ruby-vips 2.2.1 or higher. A proof-of-concept exploit has been published demonstrating how an attacker can use a MATLAB-formatted file disguised as a PNG to extract sensitive information such as secret_key_base, database passwords, cloud storage credentials, and API tokens."
}