If you're running Rails with Active Storage and libvips, you have a file-read primitive against your process that needs immediate attention. CVE-2026-66066 stems from libvips operations that are documented as unsafe for untrusted content being enabled by default in Rails' image processing pipeline. When your application accepts image uploads from users and uses libvips as the processor, an attacker can trigger arbitrary file reads from the Rails process — including secret_key_base, database credentials, and service tokens stored in environment variables.
This isn't a code injection bug. It's a defaults failure: Rails integrated a dependency whose security model assumes trusted operators, then made it available for the exact use case (untrusted uploads) that contradicts that model. The CVSS 9.5 reflects the severity of what this primitive enables — secret theft immediately chains to credential reuse, lateral movement, and often RCE.
Patch to 8.1.3.1 immediately. However, understand what the patch does: it disables unsafe operations by default, removing the file-read capability but also removing image processing functionality your application may depend on. After patching, audit your upload pipeline. If you need the disabled operations, you must explicitly enable them — and you bear responsibility for ensuring those operations never process untrusted input without an intervening hardening layer.
More critically: treat any deployment that ran this vulnerable configuration as potentially compromised. The vulnerability existed from the moment libvips support landed. Review logs for anomalous file access patterns, rotate all secrets (secret_key_base, database credentials, API tokens, encryption keys), and assume adversaries had access to anything in your application's environment. Patching closes the hole going forward; it does not erase the exposure window.
This is the second time Rails has followed this pattern — ImageMagick's ImageTragick in 2016 produced the same failure mode with the same fix. The framework keeps reaching for powerful image processing libraries that assume trusted operators, integrates them for untrusted upload use cases, and only hardens after a CVE. Treat this as organizational memory failure, not an isolated incident.