CVE-2026-107704: falha crítica em jtescher image_optimizer
image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 2.0%
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
jtescher · image_optimizerReferências
https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649dhttps://github.com/jtescher/image_optimizerhttps://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer.rb#L37-L47https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer/shell.rb#L30-L32https://www.vulncheck.com/advisories/image-optimizer-1.3.0-through-1.9.0-os-command-injection-via-identify-format