image_processing

Version	Released
`2.2.0` minor	Sep 29, 2026
`2.1.0` minor	Sep 01, 2026
`2.0.3` patch	Aug 06, 2026
`2.0.2` patch	Jun 03, 2026
`2.0.1` patch	May 22, 2026
`2.0.0` major	May 20, 2026
`1.14.0` minor	Feb 10, 2025
`1.13.0` minor	Jul 24, 2024
`1.12.2` patch	Mar 01, 2022
`1.12.1` patch 1 CVE	Nov 06, 2020
`1.12.0` minor 1 CVE	Sep 20, 2020
`1.11.0` minor 1 CVE	May 17, 2020
`1.10.3` patch 1 CVE	Jan 12, 2020
`1.10.2` patch 1 CVE	Jan 11, 2020
`1.10.1` patch 1 CVE	Jan 07, 2020
`1.10.0` minor 1 CVE	Dec 18, 2019
`1.9.3` patch 1 CVE	Aug 11, 2019
`1.9.2` patch 1 CVE	Jul 22, 2019
`1.9.1` patch 1 CVE	Jul 20, 2019
`1.9.0` minor 1 CVE	Apr 09, 2019
`1.8.0` minor 1 CVE	Feb 25, 2019
`1.7.1` patch 1 CVE	Sep 26, 2018
`1.7.0` minor 1 CVE	Sep 20, 2018
`1.6.0` minor 1 CVE	Jul 13, 2018
`1.5.0` minor 1 CVE	Jul 09, 2018
`1.4.0` minor 1 CVE	Jun 15, 2018
`1.3.0` minor 1 CVE	Jun 13, 2018
`1.2.0` minor 1 CVE	Apr 18, 2018
`1.1.0` minor 1 CVE	Apr 05, 2018
`1.0.0` major 1 CVE	Apr 04, 2018
`0.11.2` patch 1 CVE	Mar 30, 2018
`0.11.1` patch 1 CVE	Mar 27, 2018
`0.11.0` minor 1 CVE	Mar 27, 2018
`0.10.3` patch 1 CVE	Mar 24, 2018
`0.10.2` patch 1 CVE	Mar 22, 2018
`0.10.1` patch 1 CVE	Mar 22, 2018
`0.10.0` minor 1 CVE	Mar 21, 2018
`0.9.0` minor 1 CVE	Mar 16, 2018
`0.4.5` patch 1 CVE	Sep 08, 2017
`0.4.2` patch 1 CVE	Jun 15, 2017
`0.4.3` patch 1 CVE	Jun 15, 2017
`0.4.4` patch 1 CVE	Jun 15, 2017
`0.4.1` patch 1 CVE	Sep 08, 2016
`0.4.0` minor 1 CVE	Jul 11, 2016
`0.3.0` minor 1 CVE	May 03, 2016
`0.2.5` patch 1 CVE	Mar 24, 2016
`0.2.4` patch 1 CVE	Oct 21, 2015
`0.2.3` patch 1 CVE	Oct 17, 2015
`0.2.2` patch 1 CVE	Oct 04, 2015
`0.2.1` initial 1 CVE	Oct 03, 2015

2.2.0 minor

Sep 29, 2026

2.1.0 minor

Sep 01, 2026

2.0.3 patch

Aug 06, 2026

2.0.2 patch

Jun 03, 2026

2.0.1 patch

May 22, 2026

2.0.0 major

May 20, 2026

1.14.0 minor

Feb 10, 2025

1.13.0 minor

Jul 24, 2024

1.12.2 patch

Mar 01, 2022

1.12.1 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Nov 06, 2020

1.12.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 20, 2020

1.11.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

May 17, 2020

1.10.3 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 12, 2020

1.10.2 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 11, 2020

1.10.1 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 07, 2020

1.10.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Dec 18, 2019

1.9.3 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 11, 2019

1.9.2 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 22, 2019

1.9.1 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 20, 2019

1.9.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Apr 09, 2019

1.8.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Feb 25, 2019

1.7.1 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 26, 2018

1.7.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 20, 2018

1.6.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 13, 2018

1.5.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 09, 2018

1.4.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jun 15, 2018

1.3.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jun 13, 2018

1.2.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Apr 18, 2018

1.1.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Apr 05, 2018

1.0.0 major

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Apr 04, 2018

0.11.2 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 30, 2018

0.11.1 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 27, 2018

0.11.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 27, 2018

0.10.3 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 24, 2018

0.10.2 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 22, 2018

0.10.1 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 22, 2018

0.10.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 21, 2018

0.9.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 16, 2018

0.4.5 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 08, 2017

0.4.2 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jun 15, 2017

0.4.3 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jun 15, 2017

0.4.4 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jun 15, 2017

0.4.1 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 08, 2016

0.4.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 11, 2016

0.3.0 minor

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

May 03, 2016

0.2.5 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 24, 2016

0.2.4 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 21, 2015

0.2.3 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 17, 2015

0.2.2 patch

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 04, 2015

0.2.1 initial

1 CVE

CVE-2022-24720 GHSA-cxf7-qrc5-9446 Mar 01, 2022

Remote shell execution vulnerability in image_processing

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)

Affected versions


          0.10.0


          0.10.1


          0.10.2


          0.10.3


          0.11.0


          0.11.1


          0.11.2


          0.2.1


          0.2.2


          0.2.3


          0.2.4


          0.2.5

+ 29 more


            0.3.0


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.9.0


            1.0.0


            1.1.0


            1.10.0


            1.10.1


            1.10.2


            1.10.3


            1.11.0


            1.12.0


            1.12.1


            1.2.0


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.7.1


            1.8.0


            1.9.0


            1.9.1


            1.9.2


            1.9.3

Fixed in


          1.12.2

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 03, 2015

Activity

Reach

Details