Skip to content
Fencer Vulns
critical 9.8

CVE-2022-24720 json

Improper Input Validation in image_processing

published 2022-03-01 4 y ago modified 2026-06-17 4 mo ago also GHSA-cxf7-qrc5-9446 , EUVD-2022-1412

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Patch / fix

  • rubygems image_processing 1.12.2
  • image_processing_project image_processing 1.12.2
  • ruby-image-processing Debian 12 1.10.3-2

debian advisories DEBIAN-CVE-2022-24720

  • ruby-image-processing Ubuntu 20.04 LTS 1.10.3-1ubuntu0.20.04.1
  • ruby-image-processing Ubuntu 22.04 LTS 1.10.3-1ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2022-24720

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-24720 updated cvss 9.8

rubygem-image_processing: remote shell execution via #apply method

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

2.69% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems image_processing
<1.12.2
1.12.2

Affected products

  • janko image_processing

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.