AIKIDO-2026-618726

TL;DR

Operation and MiniMagick loader/saver option names taken from caller input are dispatched to the underlying image library without fully checking whether the name resolves to an unsafe Ruby core method. A crafted name can invoke methods such as eval, send, or instance_eval, so an attacker who controls those names can execute arbitrary Ruby code or shell commands on the server. The fix validates every operation and loader/saver option name at the point it is dispatched, closing bypasses that slipped past the outer-level checks.