CVE-2026-107704
9.8 CRITICALpublic exploit availablePublished 2026-10-08 · Updated 2026-10-09
AI risk analysis
- Summary
- This vulnerability allows attackers to execute arbitrary commands by injecting shell metacharacters into the image path, posing a significant risk to system security.
- Exploitability
- Exploitation is relatively straightforward given that attackers need control over the image path, such as an uploaded file name, and the identify option must be enabled.
- Blast radius
- If exploited, this could lead to complete system compromise, allowing attackers to execute commands with the privileges of the Ruby process.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to image_optimizer version 1.9.1 or later.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Public exploit & PoC references
- https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d
- https://github.com/jtescher/image_optimizer
- https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer.rb#L37-L47
- https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer/shell.rb#L30-L32
- https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d
All references
- https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d
- https://github.com/jtescher/image_optimizer
- https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer.rb#L37-L47
- https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer/shell.rb#L30-L32
- https://www.vulncheck.com/advisories/image-optimizer-1.3.0-through-1.9.0-os-command-injection-via-identify-format
- https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100368PoC
- HIGHCVE-2026-100844PoC
- CRITICALCVE-2026-100896PoC
- CRITICALCVE-2026-101001PoC
- CRITICALCVE-2026-101002PoC
- HIGHCVE-2026-101007PoC
- HIGHCVE-2026-101009PoC
- CRITICALCVE-2026-101072PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.