ANALYSIS · 29b0dc9a· FINISHED 2026-09-05 · PATCHDIFF

railsv8.1.3 → v8.1.3.1✓ COMPLETED

Files38

Vulnerable5

True positives2

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-66066

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 38 CVE 1 Vuln 5

SORT

1 files · page 1/1

activestorage/CHANGELOG.md

AI: 1 vulnerabilities

CVE-2026-66066 1 TP

#%!d(float64=023)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-66066

Security writeup for CVE-2026-66066

✓ 1 FILE

## The Exploit

An attacker with the ability to upload or process an untrusted image file (BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, FITS, JXL) through a Rails Active Storage application running Rails < 8.1.3.1 can trigger arbitrary code execution during image processing. No authentication is required if the application accepts file uploads from anonymous users.

```bash
# Attacker uploads a malicious BMP file via a public endpoint
curl -X POST https://target.rails.app/attachments \
  -F "file=@malicious.bmp" \
  -F "content_type=image/bmp"

# The application processes the image using libvips without blocking unfuzzed loaders
# BMP is an unfuzzed loader in libvips — processing triggers memory corruption
# or code execution via crafted BMP headers

# Attacker observes: 
# - 500 error with stack trace showing libvips processing, or
# - Successful response followed by arbitrary command execution on the server
```

The application silently calls `Vips::Image.new(file_path)` or similar during image validation, attachment processing, or thumbnail generation. Because the vulnerable Rails version does not call `Vips.block_untrusted(true)` at boot, libvips loads and executes the unfuzzed BMP decoder against attacker-controlled bytes, crossing the trust boundary from untrusted input to arbitrary code.

---

## What the Patch Did

**Before:**
```ruby
# Rails 8.1.3.0 and earlier
# No mitigation — libvips unfuzzed loaders enabled by default
# Active Storage processes images directly:
image = Vips::Image.new_from_file(attachment.path)
# BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, FITS, JXL loaders run unfuzzed
```

**After:**
```ruby
# Rails 8.1.3.1 (July 29, 2026)
Vips.block_untrusted(true)
# Disables all unfuzzed/untrusted image loaders and savers at boot
# Applications needing specific loaders must explicitly re-enable in initializer:
# Vips.block_untrusted(true, libvips_unsafe_loader: true)
```

The patch added a single security control: **`Vips.block_untrusted(true)` invocation during Rails initialization**. This call instructs the libvips C library to reject any format marked as "unfuzzed" (i.e., not fuzz-tested for memory safety). The fix enforces a deny-by-default stance on untrusted image formats, requiring explicit opt-in rather than silent processing.

---

## Root Cause

**CWE-94: Improper Control of Generation of Code ('Code Injection')** — libvips's unfuzzed loaders contain memory-safety bugs triggered by crafted image headers. The vulnerability exists because Active Storage in Rails < 8.1.3.1 performs image processing without restricting which decoders libvips may use. When an attacker uploads a BMP, ICO, PSD, or other unfuzzed format, the request flows through the attachment controller → storage backend → `Vips::Image.new()` or similar. At the libvips C layer, the unfuzzed decoder runs against untrusted bytes without bounds checking, allowing heap overflow, use-after-free, or other memory corruption that translates to RCE. The trust boundary is crossed at the moment `Vips.block_untrusted()` is *not* called—there is no enforcement that separates trusted image formats from untrusted ones.

---

## Why It Works

The load-bearing line is **`Vips.block_untrusted(true)`**. Removing it restores the vulnerability immediately: libvips will again attempt to decode any format, including unfuzzed ones. The patch succeeds because it flips the default from "trust all loaders" to "trust none" — a least-privilege approach. The secondary documentation about re-enabling loaders in an initializer exists to preserve backwards compatibility for applications that genuinely need PSD or JXL support and have validated their input or accepted the risk. The changelog entry itself (quoted in the patch evidence) serves as defence-in-depth by alerting maintainers to the issue and the mitigation strategy, ensuring those who run Rails 8.1.3.1 understand why their BMP processing might suddenly fail and how to recover if needed.

---

## Hardening Checklist

- **Call `Vips.block_untrusted(true)` at application boot** (Rails initializer or equivalent). Do not rely on default settings; explicitly deny untrusted formats in every Ruby on Rails or libvips-using application.
- **Validate image MIME type and magic bytes** using a library like `ruby-magic` or `fastimage` before passing the file to libvips; reject BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, FITS, and JXL unless explicitly required by business logic.
- **Re-enable unfuzzed loaders only in a scoped initializer** with a comment justifying the decision; audit that initializer quarterly to ensure the justification still holds.
- **Use a dedicated image processing worker process** (Sidekiq, DelayedJob) rather than processing in the web server, so memory corruption crashes the worker, not the main application.
- **Monitor libvips security advisories** and subscribe to Rails security announcements; unfuzzed formats may change as libvips continues development.

---

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-66066
- Rails Security Advisories: GHSA-xr9x-r78c-5hrm (libvips unfuzzed loaders)
- libvips documentation: `Vips.block_untrusted()` API reference

CVE CVE-2026-66066

PRODUCT rails

AFFECTED ≤ v8.1.3

FIXED IN v8.1.3.1

STATUS Generated

Security writeup · CVE-2026-66066

Source files · 1

activestorage/CHANGELOG.md Linked

↗ NVD