CVE-2026-107704 Details

A command injection vulnerability has been identified in the image_optimizer Ruby gem, specifically in versions 1.3.0 through 1.9.0. The issue arises in the ImageOptimizer#identify_format method, where user-supplied image paths can be manipulated to execute arbitrary commands. This exploitation occurs when the identify option is enabled, allowing attackers to append shell metacharacters to the image path. The injected commands are executed with the privileges of the Ruby process, potentially leading to unauthorized actions on the server.

Users can upgrade to version 1.9.1 or later, where this vulnerability has been addressed. If an immediate upgrade is not possible, the vulnerability can be mitigated by avoiding the use of the identify option or by sanitizing the image path to remove any potentially harmful characters before it is processed by the ImageOptimizer.