CVE-2022-21831

A flaw was found in the Active Storage module of Rails, where the transformation method or its arguments for image_processing are not trusted arbitrary input. This flaw allows an attacker to inject code in Rails.

Mitigation

To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments. Additionally, a strict image magick security policy will help mitigate this issue:

<https://imagemagick.org/script/security-policy.php&gt;