rails-security active-storage rce vips patch-urgent

Rails Active Storage vips RCE requires immediate patching

Default Rails 7.x/8.x with Active Storage + vips processor exposes arbitrary file read and RCE if your app accepts untrusted image uploads; patch to 7.2.3.2, 8.0.5.1, or 8.1.3.1 immediately, and verify libvips ≥ 8.13.

Summary

Active Storage ships enabled by default in production Rails apps. This vulnerability chains image upload handling to code execution without requiring authentication in some scenarios, making it a runtime blocker for any Rails service processing user-uploaded images.

Why it matters

Implementation verdict

Upgrade Rails to patched versions (7.2.3.2+, 8.0.5.1+, 8.1.3.1+). Separately verify libvips ≥ 8.13; earlier versions cannot disable unsafe operations even after Rails patch. If upgrade blocked, set VIPS_BLOCK_UNTRUSTED=1 or call Vips.block_untrusted(true) as temporary mitigation. WAF is insufficient. Do not delay—PoC reconstruction is likely once diffs go public.

Sources

1.Arbitrary file read and remote code execution chain affecting default Rails applications that use Active Storage with the vips image processor
2.move to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 (or later)
3.the fix depends on libvips itself being version 8.13 or later, earlier libvips builds can't disable the unsafe operations involved at all
4.Rails 7.0.0 through 7.2.3.1 and 8.0.0 through 8.1.3 don't have that requirement
5.assumes attackers with AI tooling can reconstruct one quickly once patches ship and diffs go public

Dev Signal

Get briefs like this in your inbox — free, every weekday.

100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.

Read the full issue →All briefs