Organizations risk RCE if image_optimizer 1.3.0-1.9.0 processes user-controlled paths

A critical security flaw has been identified in the image_optimizer Ruby gem, affecting versions 1.3.0 through 1.9.0. The vulnerability, tracked as CVE-2026-107704, allows attackers to execute arbitrary operating system commands by supplying a manipulated file path when the gem’s identify option is active.

What happened

The image_optimizer gem, developed by jtescher, contains an OS command injection vulnerability within its ImageOptimizer#identify_format method. According to the National Vulnerability Database, this flaw is rated as critical with a CVSS score of 9.3. The issue arises when the identify option is enabled in the gem’s configuration.

If an attacker can control the image path passed to the gem—such as through a user-uploaded file name—they can append shell metacharacters like semicolons. These characters break out of the intended command structure. The resulting string is then executed via Ruby backticks. This mechanism allows the attacker to run commands with the same privileges as the Ruby process hosting the application. The vulnerability is classified under CWE-78, which covers improper neutralisation of special elements used in an OS command.

Why it matters

Remote code execution vulnerabilities in widely used libraries pose a significant risk to web applications that handle user uploads. When the identify option is turned on, the gem attempts to determine the format of an image file. This process relies on external system commands. If the input path is not strictly sanitised, the application becomes susceptible to injection attacks.

Security teams should be aware that any application using image_optimizer versions 1.3.0 to 1.9.0 with the identify feature enabled is potentially exposed. The impact depends on the privileges of the underlying Ruby process. If the process runs with elevated permissions, the consequences of exploitation could be severe, including full system compromise. The vulnerability highlights the dangers of passing user-controlled data directly into system shell commands without adequate validation.

What happens next

Organisations using the affected gem should immediately audit their codebases for instances of image_optimizer. They need to verify which versions are in use and whether the identify option is enabled. If the option is not strictly necessary, disabling it may mitigate the risk. Teams should also review their file upload handling procedures to ensure that file names and paths are sanitised before being passed to any library that interacts with the operating system. Monitoring logs for unusual command execution patterns can help detect potential exploitation attempts.

What to do and how to stay safe: image_optimizer

• Audit your Ruby applications to identify if you are using image_optimizer versions 1.3.0 through 1.9.0.
• Check if the identify option is enabled in your configuration; disable it if it is not essential for your workflow.
• Implement strict input validation for any file paths or names provided by users before they are processed by the gem.
• Once the vendor provides an update, apply the patch immediately to resolve the vulnerability.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter

General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of image_optimizer are affected by CVE-2026-107704?

Versions 1.3.0 through 1.9.0 of the image_optimizer Ruby gem are affected.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-107704 as critical with a CVSS score of 9.3.

How do attackers exploit this flaw?

Attackers supply a crafted image path containing shell metacharacters, which are executed via Ruby backticks when the identify option is enabled.