Ruby image_optimizer gem vulnerable to RCE via shell metacharacters in versions 1.3.0-1.9.0
The image_optimizer Ruby gem allows remote code execution via crafted file paths when the identify option is enabled, posing a critical risk to applications.
Key points
- CVE-2026-107704 is rated CVSS 9.3 Critical by the National Vulnerability Database.
- The flaw affects image_optimizer versions 1.3.0 through 1.9.0.
- Attackers can execute OS commands with Ruby process privileges via shell metacharacters.
A critical vulnerability in the widely used image_optimizer Ruby gem allows attackers to execute arbitrary operating system commands. The flaw, tracked as CVE-2026-107704, carries a CVSS score of 9.3, indicating severe potential impact on affected systems.
The risk
The vulnerability stems from improper input validation within the `ImageOptimizer#identify_format` method. When the `identify` option is enabled, the gem processes file paths using Ruby backticks, which execute shell commands. According to the National Vulnerability Database, attackers who can control the file path—such as through uploaded filenames—can append shell metacharacters like semicolons. These characters allow the injection of additional commands that are executed with the same privileges as the Ruby process. This effectively grants remote code execution capabilities to any attacker who can influence the file path passed to the vulnerable method.
Who is exposed
Organizations using the image_optimizer gem in versions 1.3.0 through 1.9.0 are exposed to this threat. The gem is maintained by jtescher and is commonly used in Ruby on Rails applications for optimizing image assets. Any application that enables the `identify` feature and accepts user-supplied file names or paths is at risk. The severity is amplified in environments where the Ruby process runs with elevated privileges or has access to sensitive system resources.
Cost and compliance
The National Vulnerability Database classifies this as a CWE-78 (OS Command Injection) weakness. A CVSS 9.3 rating typically triggers immediate incident response protocols in regulated industries. Failure to address such a high-severity vulnerability can lead to compliance violations under frameworks like PCI DSS or HIPAA, depending on the data processed by the affected application. The potential for full system compromise means the operational cost of remediation must be weighed against the risk of data breach or service disruption.
What should you do?
Managers should immediately audit their Ruby applications for use of the image_optimizer gem. If the gem is present, verify the version number and check if the `identify` option is enabled. Disable the feature if it is not strictly necessary, and restrict file upload capabilities to prevent user-controlled paths from reaching the vulnerable method.
Background: Remote code execution vulnerabilities
Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.
Read the full guide: Remote Code Execution Risks and Protection for Small Businesses
What to do and how to stay safe: image_optimizer
- Inventory all Ruby projects to identify if image_optimizer versions 1.3.0 through 1.9.0 are in use.
- Disable the `identify` option in the gem configuration if it is not required for your application’s functionality.
- Implement strict input validation and sanitization for all file paths and names before they are processed by the gem.
- Monitor logs for unusual shell command execution or unexpected process spawns that may indicate exploitation.
Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107704?
It is a critical OS command injection vulnerability in the image_optimizer Ruby gem that allows attackers to execute commands via crafted file paths.
Which versions of image_optimizer are affected?
Versions 1.3.0 through 1.9.0 are affected by this vulnerability.
How do attackers exploit this flaw?
Attackers supply crafted image paths containing shell metacharacters like semicolons when the identify option is enabled, leading to command execution via Ruby backticks.
