EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Jul 30·5 min read
KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066)
TL;DR
A critical remote code execution vulnerability has been discovered in Ruby on Rails' Active Storage framework, affecting many production applications. Immediate upgrades are necessary to mitigate potential exploitation.
✦ Why It Matters
Upgrade your Ruby on Rails applications immediately to protect against this critical vulnerability.
Key Takeaways
- Upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 or later.
- Ensure libvips is version 8.13 or higher.
- Do not accept image uploads from untrusted users.
- Consider using a Web Application Firewall (WAF) as a temporary measure.
Full Summary
Ruby on Rails, a popular web framework, includes Active Storage for file attachments and image processing, which is often enabled by default. A vulnerability, identified as CVE-2026-66066, allows for remote code execution (RCE) if applications accept image uploads from untrusted users and use the vips image processor.
This issue affects Rails versions 7.x and 8.x by default, while Rails 6.x is only at risk if Active Storage is customized. The vulnerability can lead to arbitrary file reads and RCE, posing significant security risks.
Users are advised to upgrade to Rails versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 or later, and ensure their libvips version is 8.13 or higher to fully mitigate the threat.