Critical RCE in Ruby on Rails Active Storage

A critical vulnerability, tracked as CVE-2026-66066 and dubbed KindaRails2Shell, has been identified in the Ruby on Rails Active Storage framework. The flaw arises from insecure default configurations where Rails fails to block 'unfuzzed' or untrusted operations in the libvips image processing library. By uploading a specially crafted file that mimics certain formats (e.g., MATLAB Level 5), an unauthenticated attacker can trigger libvips to read arbitrary files from the server, including the application's environment and configuration files.

The impact is severe, as exposed secrets such as 'secret_key_base', database credentials, and cloud storage keys can be leveraged to achieve remote code execution (RCE) and lateral movement. As of late August 2026, threat actors have begun active exploitation of this flaw following the release of public proof-of-concept code and forensic investigation details.

Organizations using Rails 7.x or 8.x with the default libvips processor are at immediate risk if they accept image uploads from untrusted users. Immediate patching of Rails and upgrading libvips to version 8.13 or higher is required to mitigate the threat.