---
title: Ruby on Rails Patches Critical RCE Vulnerability
description: Patch critical Ruby on Rails vulnerability (CVE-2026-66066) affecting Active Storage. Update libvips and ruby-vips, then rotate your secrets.
canonical_url: https://codekeeper.co/ticker/ruby-on-rails-critical-vulnerability-patch
---

# Ruby on Rails Patches Critical RCE Vulnerability

Patch critical Ruby on Rails vulnerability (CVE-2026-66066) affecting Active Storage. Update libvips and ruby-vips, then rotate your secrets.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 2, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Ruby on Rails has patched a critical vulnerability (CVE-2026-66066, CVSS 9.5) that could let unauthenticated attackers read arbitrary files and achieve remote code execution. The flaw affects applications using the libvips library for Active Storage image processing that accept uploads from untrusted users — a very common setup. Attackers could upload a crafted file to expose secrets like secret_key_base, then escalate to full RCE or lateral movement. Fixes are available in Active Storage versions 7.2.3.2, 8.0.5.1 and 8.1.3.1. You also need libvips 8.13 or later and, where ruby-vips is installed, ruby-vips 2.2.1 or later. No active exploitation had been detected as of July 30, but proof-of-concept exploit code is already public — researchers reverse-engineered the flaw and published working chains, prompting Rails to bring its full technical disclosure forward from August 28. Rotate everything the application process could reach: secret_key_base, the Rails master key and the credentials it decrypts, storage service and database credentials, and third-party service tokens. _Updated 11 Aug 2026: A Metasploit module for this flaw was published on 3 August, putting a working exploit in the hands of any attacker with the framework installed. Patch and rotate immediately if you haven't._ Source: [SecurityWeek](https://www.securityweek.com/ruby-on-rails-patches-critical-vulnerability/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fruby-on-rails-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks North Korea Suspected in $351 Million Bitget Crypto Heist Sep 28, 2026](https://codekeeper.co/ticker/bitget-crypto-hack-north-korean-hackers)

[Klue Breach Expands: Dozens of Customers Compromised as Hackers Turn on Each Other Aug 12, 2026](https://codekeeper.co/ticker/klue-supply-chain-attack-exposes-data)

[Cyberattacks OpenAI Agent Breached Australian Medicare Stats Portal Unprompted, Went Unreported for Months Sep 26, 2026](https://codekeeper.co/ticker/openai-agent-hacks-australian-government)

[LiteLLM Supply Chain Attack Exposed 2,500+ Organizations Aug 13, 2026](https://codekeeper.co/ticker/supply-chain-attack-on-litellm-exposes-organizations)