CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-107704 — The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injectio...

·Source: NIST NVD

Updated:

Executive Summary

The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby pr

Analysis

The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges. CVSS Score: 9.8. Published: 2026-10-08T19:17:02.897.

Indicators of Compromise (1)

CVE (1)
CVE-2026-107704
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42 .

CVE-2026-109618CVE-2026-109619
Unit 42 (Palo Alto)
CRITICALVulnerability

Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities

The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. The post Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities appeared first on CyberScoop .

CyberScoop
MEDIUMVulnerability

Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands

Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer's operating system, thereby bypassing conventional security controls. As part of

The Hacker News