CVE-2022-24720

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

• CWE-20

• https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dadaPatch
• https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446Exploit, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5310Third Party Advisory
• https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dadaPatch
• https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446Exploit, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5310Third Party Advisory

Published

Mar 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24715Icinga Web 2 is an open source monitoring web interface, fra…8.8
• CVE-2022-24716Icinga Web 2 is an open source monitoring web interface, fra…7.5
• CVE-2022-24717ssr-pages is an HTML page builder for the purpose of server-…6.1
• CVE-2022-24718ssr-pages is an HTML page builder for the purpose of server-…6.5
• CVE-2022-24719Fluture-Node is a FP-style HTTP and streaming utils for Node…6.1
• CVE-2022-2472Improper Initialization vulnerability in the local server co…5.5
• CVE-2022-24721CometD is a scalable comet implementation for web messaging.…8.1
• CVE-2022-24722VIewComponent is a framework for building view components in…6.1
• CVE-2022-24723URI.js is a Javascript URL mutation library. Before version …5.3
• CVE-2022-24724cmark-gfm is GitHub's extended version of the C reference im…9.8
• CVE-2022-24725Shescape is a shell escape package for JavaScript. An issue …5.5
• CVE-2022-24726Istio is an open platform to connect, manage, and secure mic…7.5