AIKIDO-2026-10929
image_processing is vulnerable to Remote Code Execution (RCE)
88
High Risk
This Affects:
image_processingTL;DR
The MiniMagick backend applies loader and saver option hashes through apply_options, which used Ruby send to invoke option names on the underlying MiniMagick::Tool object. Because send can call private methods such as Kernel#system, an attacker who can supply loader or saver option keys can trigger arbitrary shell commands when those options are passed to ImageProcessing::MiniMagick.loader or .saver. Before the fix, values like system: "touch /tmp/pwned" could execute on the host. The patch switches to public_send, which restricts dispatch to public methods and blocks this command-injection path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
image_processing is vulnerable to Remote Code Execution (RCE) in versions 0.11.0 - 2.0.0.
How to fix this
Upgrade the image_processing library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant