Critical file read and code execution flaw in Rails Active Storage
A vulnerability in Rails Active Storage using libvips allows attackers to read files or execute code, so developers using these tools must update their systems.
What happened
A flaw in how Active Storage processes images with libvips allows attackers to read sensitive files from the server. This vulnerability can lead to full remote code execution if an attacker uploads a specially crafted image. The issue stems from untrusted image processing and affects several recent versions of the framework.
Who is affected
You are at risk if your Rails application uses Active Storage with the libvips library to handle user uploads. Applications running Rails versions 7.2, 8.0, or 8.1 are vulnerable until they reach the specified patch levels.
Why it matters if you build with AI
Many AI agents and tools generate Rails code or help manage image processing pipelines automatically. If your AI-assisted workflow relies on vulnerable versions of these libraries, your application environment could be exposed to total compromise. Attackers can use this access to steal environment variables or secret keys used by your AI services.
What to do
- Update Rails to version 7.2.3.2, 8.0.5.1, or 8.1.3.1
- Upgrade libvips to version 8.13 or later
- Rotate the secret_key_base and all service credentials
- Set VIPS_BLOCK_UNTRUSTED as a temporary stopgap
Locaas is being built to track advisories like this, check your running applications and propose the necessary updates for your approval.
Get early access