Patch Your Rails: Active Storage CVE-2026-66066
8 relevance
Score Breakdown
technical depth 8
novelty 8
actionability 9
community 7
strategic 8
personal 7
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Critical Rails security vulnerability with patch instructions, highly actionable and strategic.
Summary
CVE-2026-66066 exposes Rails apps using Active Storage with libvips to arbitrary file read and RCE via crafted image uploads triggering variant generation—libvips marks some handlers as 'unfuzzed'. Rails patched in 7.2.3.2, 8.0.5.1, and 8.1.3.1; upgrade and rotate all secrets as they may be compromised. For those unable to upgrade immediately, set VIPS_BLOCK_UNTRUSTED or call Vips.block_untrusted(true) with libvips ≥8.13.