image_optimizer Ruby gem: OS command injection via identify option
Summary
The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contain an OS command injection in ImageOptimizer#identify_format. When the identify option is enabled, an image path containing shell metacharacters, such as an uploaded file name, is passed unescaped to a shell command. An attacker who controls the path can run arbitrary commands with the privileges of the Ruby process. The issue requires the identify option and a path influenced by users.
Affected
- image_optimizer (RubyGems, jtescher) 1.3.0 through 1.9.0
- Default configuration (identify option disabled) is not affected according to the CVE record.
Fixed in
Unknown. No fixed release is confirmed. 1.9.0 is the latest release listed, and the OSV data is contradictory.
Workaround
- Disable the identify option.
- Do not pass user-controlled file names or paths to the gem. Rename uploads to server-generated names before processing.
- Run the Ruby process with minimal privileges and restricted file-system access.
Exploitation
- CISA SSVC assessment: exploitation status 'poc', automatable: yes, technical impact: total.
- A proof-of-concept gist is referenced in the CVE record.
- No confirmed exploitation in the wild is known.
Our recommendation
- Inventory Gemfile.lock files for image_optimizer and check whether the identify option is used.
- Disable identify or remove the gem where it is not required.
- Keep user-supplied paths away from the gem and monitor for unexpected process execution.
- Watch for a verified fixed release and update once it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gist: image_optimizer OS command injection (R3tro16) gist.github.com
- GitHub: jtescher/image_optimizer github.com
- image_optimizer v1.9.0: lib/image_optimizer.rb github.com
- image_optimizer v1.9.0: lib/image_optimizer/shell.rb github.com
- VulnCheck advisory: image_optimizer 1.3.0 through 1.9.0 www.vulncheck.com
- OSV: CVE-2026-107704 osv.dev
- VulDB: CVE-2026-107704 vuldb.com
- Vulners (Rapid7): CVE-2026-107704 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:56.
Original description (NVD)
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
NVD references (6)
- https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d
- https://github.com/jtescher/image_optimizer
- https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer.rb#L37-L47
- https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer/shell.rb#L30-L32
- https://www.vulncheck.com/advisories/image-optimizer-1.3.0-through-1.9.0-os-command-injection-via-identify-fo…
- https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.