Upgrade image_optimizer beyond 1.9.0 to neutralize CVE-2026-107704 command injection exploits targeting crafted paths

A critical security vulnerability has been identified in the image_optimizer Ruby gem, exposing applications to remote code execution. The flaw, tracked as CVE-2026-107704, allows attackers to inject and execute operating system commands by manipulating image file paths when specific configuration options are enabled.

The National Vulnerability Database (NVD) rates CVE-2026-107704 as critical with a CVSS score of 9.3. The vulnerability stems from improper input sanitization within the ImageOptimizer#identify_format method. When the identify option is active, the gem processes file paths using Ruby backticks, which execute shell commands. If an attacker can control the file path—such as through a maliciously named uploaded file—they can append shell metacharacters like semicolons. These characters break out of the intended command structure, allowing the attacker to run arbitrary system commands with the same privileges as the Ruby process.

Technical Mechanics of the Exploit

The core issue lies in how the image_optimizer gem handles the identification of image formats. According to the NVD record, the vulnerability is classified under CWE-78, which pertains to OS command injection. The ImageOptimizer#identify_format method is designed to determine the format of an image file. However, it fails to properly sanitize the file path argument before passing it to a shell execution context via Ruby backticks.

This lack of sanitization creates a direct pathway for command injection. An attacker does not need to exploit complex memory corruption or buffer overflows. Instead, they simply need to supply a crafted string as the image path. By including shell metacharacters, such as a semicolon followed by a malicious command, the attacker can chain their own instructions to the legitimate format identification command. The Ruby interpreter then executes these chained commands, granting the attacker access to the underlying operating system.

Scope of Affected Systems

The vulnerability impacts the image_optimizer gem developed by jtescher. Specifically, versions 1.3.0 through 1.9.0 are affected. Any application or service that integrates this gem for image processing tasks and enables the identify option is potentially vulnerable. This includes web applications that allow users to upload images, as the uploaded file name often becomes part of the path processed by the gem.

Small-business owners and developers using Ruby on Rails or other Ruby-based frameworks should audit their dependency lists immediately. The presence of image_optimizer in the version range 1.3.0 to 1.9.0 indicates exposure. The severity of the issue is heightened by the fact that the executed commands run with the privileges of the Ruby process, which often have significant access to application data and system resources.

What to watch

Security researchers and administrators should monitor vendor communications for official patches or mitigation guidance. Since no fix has been confirmed yet in the provided materials, the primary focus should be on containment and exposure reduction. Watch for any updates from the gem maintainer or security advisories from Ruby ecosystem security teams. Additionally, monitor logs for any unusual command executions or unexpected process spawns that could indicate an exploitation attempt.

Background: Security advisories

Security advisories provide the technical context needed to prioritize patches. They explain the severity, affected components, and mitigation steps. Without them, teams guess which fixes matter, leaving critical gaps open to exploitation while wasting time on low-risk updates.

Read the full guide: How Security Advisories Drive Patch Decisions and Reduce Risk

What to do and how to stay safe: image_optimizer

• Audit your application dependencies to identify if image_optimizer versions 1.3.0 through 1.9.0 are installed.
• Disable the identify option in the image_optimizer configuration if it is not strictly required for your application's functionality.
• Implement strict input validation for all file uploads, rejecting filenames that contain shell metacharacters such as semicolons, pipes, or backticks.
• Restrict the permissions of the Ruby process running the application to limit the potential damage if command injection occurs.

Step-by-step guide: Command Injection Prevention Checklist for Secure Applications

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107704?

CVE-2026-107704 is a critical OS command injection vulnerability in the image_optimizer Ruby gem that allows attackers to execute arbitrary commands via crafted file paths.

Which versions of image_optimizer are affected?

Versions 1.3.0 through 1.9.0 of the image_optimizer gem are affected by this vulnerability.

How can an attacker exploit this flaw?

Attackers can exploit this flaw by supplying a crafted image path containing shell metacharacters, which are then executed via Ruby backticks when the identify option is enabled.