Active Storage in Rails attempts to restrict image transformation methods to a safe default list. However, three allowed methods can be exploited to bypass these restrictions, enabling command injection when arbitrary user-supplied input is accepted as transformation methods or parameters. This vulnerability specifically impacts applications using Active Storage with the image_processing gem and mini_magick as the image processor. The unsafe usage pattern involves passing untrusted parameters directly to image transformations, such as in the example <%= image_tag blob.variant(params[:t] => params[:v]) %>. The vulnerability is tracked as CVE-2025-24293 with a CVSS 4.0 score of 9.2 (critical). No official patch links are provided in the input data, and the vendor advisory from Red Hat does not explicitly mention a fix or patch status.

This vulnerability allows an attacker to perform command injection on systems running vulnerable versions of Rails Active Storage when untrusted user input is used for image transformation methods or parameters. This can lead to remote code execution or other severe impacts depending on the context of the application and its privileges. The CVSS score of 9.2 indicates a critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

No official patch or fix is explicitly stated in the provided vendor advisory content. Users should immediately avoid accepting arbitrary user input for image transformation methods or parameters, as this is unsupported and dangerous. Strict validation of all user-supplied transformation methods and parameters must be implemented. Additionally, deploying a strong ImageMagick security policy is recommended to mitigate potential command injection risks. Monitor the vendor advisory for updates regarding official patches or fixes.