Can Attackers Run OS Commands via image_optimizer Gem's Identify Option in CVE-2026-107704?

The National Vulnerability Database (NVD) has recorded a critical security flaw in the popular Ruby gem `image_optimizer`. Designated as CVE-2026-107704, the vulnerability carries a CVSS score of 9.3, classifying it as critical. The issue resides in the `ImageOptimizer#identify_format` method and allows for operating system command injection. This affects all versions of the gem from 1.3.0 up to and including 1.9.0, created by maintainer jtescher.

How does the vulnerability work?

The flaw stems from how the `image_optimizer` gem handles file paths when the `identify` option is enabled. According to the NVD record, the `ImageOptimizer#identify_format` function fails to properly sanitize user-supplied input. An attacker who can control the path to an image file—such as through a file upload feature—can inject shell metacharacters into that path.

Specifically, attackers can append characters like semicolons (`;`) to the file path. These metacharacters are then passed directly into Ruby backticks. Because Ruby backticks execute the enclosed string as an operating system command, the injected code runs immediately. This mechanism effectively bridges the gap between a simple file path string and executable system commands.

What is the impact on an organization?

The primary risk is remote code execution. Because the injected commands are executed via Ruby backticks, they run with the same privileges as the Ruby process handling the image optimization. If the application runs with elevated permissions, the attacker gains significant control over the host system.

For business leaders, this means that any application using `image_optimizer` versions 1.3.0 through 1.9.0 with the `identify` feature active is exposed. If an attacker can manipulate the name or path of an uploaded image, they can execute arbitrary commands on the server. This could lead to data theft, system compromise, or use of the server as a pivot point for further attacks within the network.

Who is affected by this flaw?

The vulnerability specifically impacts applications using the `image_optimizer` gem maintained by jtescher. The affected version range is broad, covering releases from 1.3.0 through 1.9.0. Organizations must check their dependency trees to see if any of these versions are present.

The flaw is only exploitable if the `identify` option is enabled in the gem’s configuration. However, because this feature is commonly used to determine image formats before processing, many default or standard configurations may inadvertently leave systems vulnerable. The weakness is categorized under CWE-78, which relates to improper neutralization of special elements used in an OS command.

What steps should organizations take now?

Since the source material does not confirm the release of a patched version, organizations should assume no fix is currently available. Immediate action should focus on mitigation and containment.

First, audit all applications to determine if `image_optimizer` versions 1.3.0 through 1.9.0 are in use. If they are, disable the `identify` option if it is not strictly necessary for business operations. This removes the specific code path that triggers the vulnerability. Second, implement strict input validation on file uploads to reject filenames containing shell metacharacters such as semicolons. Finally, monitor logs for any unusual command executions or process spawns that may indicate an active exploitation attempt.

What to do and how to stay safe: image_optimizer

• Updates often introduce new compatibility issues that require careful testing before deployment.
• Unpatched systems expose known flaws that attackers can exploit using publicly available tools.
• Automated patching reduces human error but can break complex application dependencies if not monitored.

Patch management is a continuous cycle of identification, testing, and verification, not a one-time task. Start by building a complete inventory of your software assets to establish visibility.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for the image_optimizer vulnerability?

The vulnerability is tracked as CVE-2026-107704.

Which versions of image_optimizer are affected?

Versions 1.3.0 through 1.9.0 are affected by this flaw.

How severe is this vulnerability?

It is rated as Critical with a CVSS score of 9.3.