A critical vulnerability, designated CVE-2026-66066 and nicknamed "KindaRails2Shell," has been identified in Ruby on Rails (Rails), a widely used framework for web applications. The flaw could allow unauthenticated attackers to read arbitrary files from a server and, in some configurations, achieve full remote code execution.
The vulnerability stems from the interaction between Rails' Active Storage component and the image-processing library libvips. Active Storage, which handles image uploads and resizing, utilizes libvips for these operations. While libvips is designed to process various image formats, it also supports obscure scientific and specialty file types, including MATLAB .mat files, NIfTI medical scans, SVG, and PDF files. The issue arises because libvips's tools for handling some of these formats are unsafe when processing untrusted input, and Rails applications were not configured to disable these risky operations.
This oversight allows an attacker to craft a malicious file that appears to be a harmless image. When the server attempts to generate a thumbnail or variant of this file, the embedded instructions within the file can compel the server to read sensitive data. In its default configuration, a Rails application displaying image variants could enable an attacker to read arbitrary server files, including the process environment. This environment typically contains the `secret_key_base` and often credentials for external systems, which could lead to escalation to remote code execution or lateral movement to other systems.
Applications are exposed to this vulnerability if they use Active Storage with the default `vips` image processor, which has been standard since Rails 7. This includes applications that allow users to upload images through features like avatars, thumbnails, or profile pictures. Specifically, affected Active Storage versions are 7.0 releases prior to 7.2.3.2, 8.0 releases prior to 8.0.5.1, and 8.1 releases prior to 8.1.3.1. Rails versions 6.0.0 through 6.1.7.10 are only affected if Active Storage has been configured outside its default settings. Applications using the alternative ImageMagick processor are not vulnerable.
The vulnerability was independently discovered and reported by researchers André Baptista, Bruno Mendes, and Rafael Castilho of the Ethiack team, and also by RyotaK of GMO Flatt Security. Rails released patches on July 29, 2026, in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.
Users are strongly advised to upgrade to one of the patched Rails versions. Additionally, it is recommended to update libvips to version 8.13 or later. As a precautionary measure, users should rotate their application's master key, database credentials, storage service keys (for S3, GCS, or Azure), and any third-party service tokens or keys that may have been exposed. For systems where libvips 8.13 is already present, applications can disable the vulnerable operations without upgrading Rails by setting the `VIPS_BLOCK_UNTRUSTED` environment variable.
While security vendors have deployed web application firewall (WAF) rules to detect and block known exploit patterns for KindaRails2Shell, these are not a substitute for applying the official patches.
Initially, details and exploit code were withheld to allow time for patching. However, other researchers subsequently reverse-engineered the attack and published proof-of-concept exploits. This prompted the Ethiack researchers to release a technical deep-dive into the vulnerability. The Rails team has also provided agent skills to help organizations check if their applications were vulnerable, for how long, and whether any sensitive information was accessed. These resources include an explainer of the attack and guidance for investigating potential intrusions.
There are currently no public reports of CVE-2026-66066 being actively exploited in the wild. However, given the severity of the flaw and the increasing availability of working exploit material, affected users are urged to patch and investigate quickly.
