Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107704image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

Critical 9.8

In plain English

A critical-severity OS command injection in image_optimizer from jtescher. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.0%top 18.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.

Affected products (as reported)

Vendor	Product	Versions
jtescher	image_optimizer	1.3.0 – through 1.9.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d third-party-advisory
https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer.rb#L37-L47 technical-description
https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer/shell.rb#L30-L32 technical-description
https://github.com/jtescher/image_optimizer product
VulnCheck Advisory: image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format third-party-advisory