$ the-wire · showcase
RAILS PATCHES LIBVIPS IMAGE VULNERABILITY ACROSS THREE VERSIONS
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
Rails shipped emergency updates to 7.2, 8.0, and 8.1 this morning, disabling untrusted image loaders that could expose your attachment pipeline to arbitrary content.
The Active Storage fix [1][2][3] closes a gap where libvips's unfuzzed loaders and savers were re-enabled despite being flagged as unsafe for untrusted input. Both the Vips analyzer and transformer were passing unvetted attachments to them, creating an attack surface that persisted since 8.2 edge. Rails will now call `Vips.block_untrusted(true)` at boot to disable them [4]. If your app processes user uploads through Active Storage, patch before your next deploy. Separately, Solid Queue 1.5.1 shipped [6] with fixes for flaky tests, migration generators, and a critical improvement: forked processes that fail to boot are now tracked and replaced within a configurable timeout [5], solving a production problem where hung boot callbacks could orphan workers. The Rails ecosystem also shipped four releases across 34 commits and 13 PRs this period [7], including Propshaft's eager manifest initialization in production, cutting first-request latency by moving asset parsing from request time to boot time.
Action items
- → Upgrade Rails to 7.2.3.2, 8.0.5.1, or 8.1.3.1 (pick your line) before next deploy rails/rails [immediate]
- → Upgrade Solid Queue to 1.5.1 to fix worker boot tracking and flaky test issues rails/solid_queue [plan]
- → Review any custom libvips configuration in Active Storage; test image uploads after patching rails/rails [plan]
References
- [1] 8.0.5.1 ↗ rails/rails
- [2] 7.2.3.2 ↗ rails/rails
- [3] 8.1.3.1 ↗ rails/rails
- [4] Disable libvips's unfuzzed image loaders and savers ↗ rails/rails
- [5] Replace forked processes that fail to boot ↗ rails/solid_queue
- [6] v1.5.1 ↗ rails/solid_queue
- [7] Eagerly initialize Manifest in Resolver::Static ↗ rails/propshaft
