Attackers Execute Ruby Commands via image_optimizer CVE-2026-107704 Using Shell Metacharacters

Developers using the image_optimizer Ruby gem face a severe security risk due to a critical vulnerability that allows remote code execution. The flaw, tracked as CVE-2026-107704, exists in versions 1.3.0 through 1.9.0 of the library. It enables attackers to inject and execute operating system commands if they can influence the file path passed to the gem’s identification feature.

In plain English

The image_optimizer gem helps applications process and optimize images. A specific function within this tool, called `identify_format`, checks image details when the "identify" option is turned on. The problem arises because this function uses Ruby backticks to run system commands. Backticks in Ruby allow code to execute shell commands directly.

If an attacker can control the name or path of an image file—such as through a file upload feature—they can insert special characters like semicolons into the file name. These characters act as separators for shell commands. When the gem processes the crafted path, it executes the attacker’s injected commands alongside the intended image identification task. This means the attacker’s code runs with the same permissions as the Ruby process handling the request.

The background

The vulnerability is classified as an OS command injection weakness, specifically CWE-78. According to the National Vulnerability Database, the issue has a CVSS score of 9.3, which rates it as critical. The flaw affects the `image_optimizer` gem maintained by jtescher. Any application using versions 1.3.0 through 1.9.0 with the identify option enabled is potentially exposed.

The risk is significant because it does not require complex exploitation techniques. If an application allows users to upload files and the backend uses image_optimizer to process those uploads with path control, the attack surface is open. The attacker does not need to authenticate or bypass traditional access controls; they simply need to provide a malicious file path.

What changes now

Organizations relying on this gem must assess their exposure immediately. The presence of the vulnerability in versions up to 1.9.0 means that many existing deployments may be vulnerable. Since the issue allows command execution with Ruby process privileges, the impact can range from data theft to full server compromise, depending on the application’s permissions.

There is no confirmed patch or fix mentioned in the current source material for this specific CVE. Teams should verify if they are using the affected versions and whether the identify option is enabled in their configurations. If the feature is not required, disabling it may mitigate the risk. Otherwise, monitoring for vendor updates is essential, as a patched version will likely be released to address the command injection flaw.

What to do and how to stay safe: image_optimizer

• Audit your Ruby applications to check if you are using image_optimizer versions 1.3.0 through 1.9.0
• Review your code to see if the identify option is enabled in image_optimizer configurations
• Restrict file upload capabilities to prevent users from controlling file names or paths if possible
• Monitor vendor announcements for a patched version of the image_optimizer gem once available

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107704?

It is a critical OS command injection vulnerability in the image_optimizer Ruby gem versions 1.3.0 through 1.9.0.

How do attackers exploit this flaw?

Attackers supply a crafted image path containing shell metacharacters like semicolons when the identify option is enabled.

What is the CVSS score for this vulnerability?

The CVSS score is 9.3, which is rated as critical.