Ruby on Rails Patches Critical Vulnerability
Ruby on Rails this week rolled out patches for a critical vulnerability that could allow unauthenticated attackers to achieve remote code execution (RCE).
A server-side web application framework written in Ruby, Ruby on Rails is used for the fast building of full-stack web applications and APIs.
Tracked as CVE-2026-66066 (CVSS score of 9.5), the critical security defect is described as an arbitrary file read that potentially exposes secrets, allowing remote attackers to execute code or move laterally to other systems.
“In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment,” Ruby on Rails’ maintainers note in an advisory.
Within the exposed environment, the advisory explains, attackers could find secret_key_base and credentials for external systems, which can be abused to escalate the attack to RCE.
The issue impacts applications that use the libvips...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
