Threat database

The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contains a critical OS command injection vulnerability in the ImageOptimizer#identify_format method. This flaw allows attackers to execute arbitrary OS commands by supplying a crafted image path when the identify option is enabled. The vulnerability arises because user-controlled input, such as an uploaded file name, is passed to Ruby backticks without proper sanitization, enabling shell metacharacters to be executed with the privileges of the Ruby process.