ON July 29, 2026, the Ruby on Rails project acknowledged CVE-2026-66066, a critical vulnerability tied to Active Storage image processing with the libvips library, rated with a CVSSv4 score of 9.5. This flaw allows unauthenticated attackers to read files within the Rails application, potentially leading to remote code execution (RCE). Rails applications using libvips to process image uploads from untrusted sources are at risk. No known exploits were identified as of July 30, 2026, but patching is urgent.
Organizations are advised to upgrade to versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 and ensure libvips 8.13 or later is installed. Temporary workarounds include setting VIPS_BLOCK_UNTRUSTED for approved libvips versions. For full remediation, consult the Ruby on Rails security advisory.