RUBY on Rails has released patches for a critical vulnerability (CVE-2026-66066) that could enable unauthenticated attackers to achieve remote code execution through arbitrary file reads. The flaw primarily affects applications using the libvips library for image processing and those allowing uploads from untrusted users. It has a high CVSS score of 9.5, indicating severe risk.
Attackers could leverage this vulnerability to access sensitive information such as secret keys and credentials stored in the application's environment. Users are urged to update their Rails deployments and the libvips library to mitigate this vulnerability. As of now, there is no evidence of exploitation in the wild.