Ruby on Rails released security updates for versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 on July 29, 2026, addressing the vulnerability CVE-2026-66066. The patches disable untrusted libvips image loaders at boot, enhancing protection for applications that process user-uploaded files, especially against crafted image attacks. Developers are advised to run `bundle update rails` and ensure that libvips is updated to version 8.13 or higher, as failure to do so will prevent Rails from booting. Although the update enhances security, it may disrupt image processing for unsupported formats like BMP and PSD, requiring adjustments in configuration
Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 Active Storage Security Patch Targets CVE-2026-66066
Ruby on Rails released coordinated security updates for versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 on July 29, 2026. The patches address CVE-2026-66066 by disabling untrusted libvips image loaders at boot, shielding apps that process user-uploaded files from crafted image attacks. Applications handling BMP, ICO, PSD, or similar formats will see variant generation break and must strip those content types from the variable_content_types config. Developers should run bundle update rails immediately and confirm libvips sits at version 8.13 or higher.
