Critical OS Command Injection Flaw Found in Ruby image_optimizer Gem

A critical operating system command injection vulnerability has been identified in the image_optimizer Ruby gem, affecting versions 1.3.0 through 1.9.0. The flaw, tracked as CVE-2026-107704, allows attackers to execute arbitrary system commands if they can control the path to an image file being processed.

The vulnerability is rated Critical with a CVSS score of 9.3, according to the National Vulnerability Database (NVD). The issue stems from improper input validation within the `ImageOptimizer#identify_format` method. When the identify option is enabled, the function fails to sanitize user-supplied image paths before passing them to the system shell. This occurs specifically when the method uses Ruby backticks to execute external commands, inheriting the privileges of the Ruby process.

Technical Context and Exploitation

The weakness is classified under CWE-78, which covers the injection of OS commands. The exploit vector requires an attacker to supply a crafted image path. If an application using image_optimizer allows users to upload files or specify filenames, an attacker can append shell metacharacters, such as a semicolon, to the filename.

For example, a malicious actor could name a file `image.jpg; rm -rf /`. When the `identify_format` method processes this path with the identify option active, the shell metacharacter separates the intended command from the attacker's injected command. The injected command is then executed via Ruby backticks. Because the execution happens within the Ruby process, the attacker gains the same system privileges as the application running the gem.

This type of vulnerability is particularly dangerous in web applications that handle user-uploaded content. If the application does not strictly validate or sanitize filenames before passing them to image optimization libraries, the attack surface is significantly widened. The use of backticks for command execution in Ruby is a known risk factor when combined with unsanitized user input, as it provides a direct bridge to the underlying operating system.

Who Is Affected

The vulnerability affects any software project that has integrated the image_optimizer Ruby gem in versions ranging from 1.3.0 up to and including 1.9.0. The gem is maintained by jtescher. Applications that rely on this library for image processing, particularly those that enable the identify option, are at risk.

Systems are only vulnerable if the specific configuration allows the identify option to be enabled. However, because this option is often used to determine image formats automatically, it may be enabled by default or in common usage patterns. Organizations using Ruby on Rails or other Ruby-based frameworks should audit their dependencies to determine if they are using the affected versions of image_optimizer.

What should you do?

No patch or fix has been confirmed yet for CVE-2026-107704. Security teams should immediately assess whether their applications use the image_optimizer gem within the affected version range (1.3.0 to 1.9.0).

If the gem is in use, administrators should consider disabling the identify option if it is not strictly necessary for their workflow. Additionally, implementing strict input validation for file paths and names at the application level can help mitigate the risk. Organizations should monitor official channels from the maintainer, jtescher, for an updated release that addresses this command injection flaw. Until a fix is available, isolating the Ruby process running the vulnerable code to limit its system privileges may reduce the potential impact of a successful exploit.