Bump rails/activestorage to 8.1.3.1 for CVE-2026-66066 - #23
Merged
Conversation
GHSA-xr9x-r78c-5hrm: Active Storage's libvips variant processor didn't disable libvips' "unfuzzed" operations, which aren't safe against untrusted input. Since Rails 7.0 defaults to `variant_processor = :vips` and this app depends on `ruby-vips`, an attacker who can upload an image and trigger variant generation could get arbitrary file read on the server, including the process environment (`secret_key_base`, credentials, etc), and potentially escalate to RCE. `~> 8.1.2` in the Gemfile already allowed the patched release, so this is just a `bundle update rails activestorage` to pull in 8.1.3.1. No app code changes needed. Co-Authored-By: Claude <noreply@anthropic.com>
zanebliss
force-pushed
the
zb/rails-security-advisory-99d42e
branch
from
July 29, 2026 16:02
9eb65db to
42a52b1
Compare
bin/brakeman passes --ensure-latest, which fails CI whenever the locked brakeman version falls behind the latest release. 8.0.5 is out, so let's bump to keep CI green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GHSA-xr9x-r78c-5hrm: Active Storage's libvips variant processor didn't disable libvips' "unfuzzed" operations, which aren't safe against untrusted input. Since Rails 7.0 defaults to
variant_processor = :vipsand this app depends onruby-vips, an attacker who can upload an image and trigger variant generation could get arbitrary file read on the server, including the process environment (secret_key_base, credentials, etc), and potentially escalate to RCE.~> 8.1.2in the Gemfile already allowed the patched release, so this is just abundle update rails activestorageto pull in 8.1.3.1. No app code changes needed. Production also needs libvips >= 8.13 and any exposed secrets rotated per the advisory.