libvips

Definition

libvips is a high-performance image processing library used by ruby-on-rails active-storage for variants. Some loaders/savers are marked “unfuzzed” (unsafe for untrusted content).

Key Points

• Versions ≥8.13 can block untrusted/unfuzzed operations (VIPS_BLOCK_UNTRUSTED or Vips.block_untrusted(true))
• Versions <8.13 cannot disable unfuzzed ops — Rails raises at boot after CVE fix
• Central to cve-2026-66066 / kindarails2shell

Related

• active-storage
• ruby-on-rails
• cve-2026-66066

Sources

• 2026-08-01-rails-ghsa-xr9x-r78c-5hrm