Rails patches critical Active Storage flaw with RCE potential

AI-suggested

A fix is available by upgrading Rails Active Storage to versions 7.2.3.2 or later, 8.0.5.1 or later, or 8.1.3.1 or later. Additionally, upgrade libvips to version 8.13 or newer. For systems running libvips 8.13 or later, administrators can temporarily disable the vulnerable functionality by setting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) in ruby-vips 2.2.1 or newer. Rotate the secret_key_base, database credentials, Active Storage service credentials, and any other secrets accessible to the application process after patching. No workaround exists for libvips versions prior to 8.13. ImageMagick users are not affected by this vulnerability. Web application firewall (WAF) protections are available from Akamai and may provide additional defense but should not replace patching.