Ruby on Rails Active Storage Remote Code Execution Vulnerability

The Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) disclosed a remote code execution vulnerability in Ruby on Rails' Active Storage component (CVE‑2026‑66066, dubbed “KindaRails2Shell”). The flaw affects Active Storage versions earlier than 7.2.3.2, 8.0.5.1 and 8.1.3.1. An attacker can upload a crafted file, read server‑side files and authentication data, and execute arbitrary code on the host.

Exploit code for the vulnerability has already been published, prompting JPCERT/CC to warn that attacks are likely to increase. Developers are urged to apply the latest security updates, treat any exposed credentials as compromised, and rotate them promptly. The advisory emphasizes immediate remediation to prevent potential breaches.

The vulnerability highlights the importance of timely patching for web‑application frameworks and the need for robust file‑upload validation in Rails‑based services.