Possible fix(deps): activestorage 8.1.3 → ~> 7.2.3, >= 7.2.3.2, ~> 8.0.5, >= 8.0.5.1, >… in Gemfile.lock

[begininvoke]

This might be a false positive, but Gemfile.lock around line 66 looked worth a second pair of eyes.

CVE-2026-66066 is a HIGH severity vulnerability in Rails Active Storage that fails to disable unsafe libvips processing operations when handling untrusted image uploads. Attackers can exploit this by uploading crafted images to trigger file disclosure, enabling unauthorized reading of arbitrary server-side files such as environment variables and application secrets (e.g., secret_key_base). This poses a severe risk of credential theft, lateral movement, and potential remote code execution. Immediate remediation via version upgrade is required.

Something like this might fix it:

Update the activestorage gem constraint in Gemfile to permit the patched release and refresh the lockfile.

diff --git a/Gemfile b/Gemfile
@@ -10,7 +10,7 @@ source 'https://rubygems.org'
 gem 'rails', '~> 8.1.0'
-gem 'activestorage', '~> 8.1.3'
+gem 'activestorage', '>= 8.1.3.1'
 gem 'puma', '>= 5.0'

Apply the change and execute: `bundle update activestorage`

For reference: rule CVE-2026-66066. Rated high.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.