{"id":"CVE-2026-107704","published":"2026-10-08T19:17:02.897","lastModified":"2026-10-09T15:17:08.667","description":"The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d","tags":[]},{"url":"https://github.com/jtescher/image_optimizer","tags":[]},{"url":"https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer.rb#L37-L47","tags":[]},{"url":"https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer/shell.rb#L30-L32","tags":[]},{"url":"https://www.vulncheck.com/advisories/image-optimizer-1.3.0-through-1.9.0-os-command-injection-via-identify-format","tags":[]},{"url":"https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d","tags":[]},{"url":"https://github.com/jtescher/image_optimizer","tags":[]},{"url":"https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer.rb#L37-L47","tags":[]},{"url":"https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer/shell.rb#L30-L32","tags":[]},{"url":"https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers to execute arbitrary commands by injecting shell metacharacters into the image path, posing a significant risk to system security.","exploitability":"Exploitation is relatively straightforward given that attackers need control over the image path, such as an uploaded file name, and the identify option must be enabled.","blast_radius":"If exploited, this could lead to complete system compromise, allowing attackers to execute commands with the privileges of the Ruby process.","remediation":"Upgrade to image_optimizer version 1.9.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","os-command-injection","ruby","patch"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:11.554Z"}}