{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Important"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66066.json"}],"title":"activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations","tracking":{"current_release_date":"2026-07-31T08:21:22+00:00","generator":{"date":"2026-07-31T08:21:22+00:00","engine":{"name":"Red Hat SDEngine","version":"5.3.8"}},"id":"CVE-2026-66066","initial_release_date":"2026-07-30T18:32:11.419000+00:00","revision_history":[{"date":"2026-07-30T18:32:11.419000+00:00","number":"1","summary":"Initial version"},{"date":"2026-07-31T08:21:15.711605+00:00","number":"2","summary":"Current version"},{"date":"2026-07-31T08:21:22+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"Red Hat 3scale API Management Platform 2","product":{"name":"Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2","product_identification_helper":{"cpe":"cpe:/a:redhat:red_hat_3scale_amp:2"}}}],"category":"product_family","name":"Red Hat 3scale API Management Platform 2"},{"branches":[{"category":"product_name","name":"Red Hat Satellite 6","product":{"name":"Red Hat Satellite 6","product_id":"red_hat_satellite_6","product_identification_helper":{"cpe":"cpe:/a:redhat:satellite:6"}}}],"category":"product_family","name":"Red Hat Satellite 6"},{"category":"product_version","name":"3scale-amp20/system","product":{"name":"3scale-amp20/system","product_id":"3scale-amp20/system","product_identification_helper":{"purl":"pkg:oci/system?repository_url=registry.redhat.io/3scale-amp20/system"}}},{"category":"product_version","name":"3scale-amp21/system","product":{"name":"3scale-amp21/system","product_id":"3scale-amp21/system","product_identification_helper":{"purl":"pkg:oci/system?repository_url=registry.redhat.io/3scale-amp21/system"}}},{"category":"product_version","name":"3scale-amp21/zync","product":{"name":"3scale-amp21/zync","product_id":"3scale-amp21/zync","product_identification_helper":{"purl":"pkg:oci/zync?repository_url=registry.redhat.io/3scale-amp21/zync"}}},{"category":"product_version","name":"3scale-amp22/system","product":{"name":"3scale-amp22/system","product_id":"3scale-amp22/system","product_identification_helper":{"purl":"pkg:oci/system?repository_url=registry.redhat.io/3scale-amp22/system"}}},{"category":"product_version","name":"3scale-amp22/zync","product":{"name":"3scale-amp22/zync","product_id":"3scale-amp22/zync","product_identification_helper":{"purl":"pkg:oci/zync?repository_url=registry.redhat.io/3scale-amp22/zync"}}},{"category":"product_version","name":"3scale-amp24/system","product":{"name":"3scale-amp24/system","product_id":"3scale-amp24/system","product_identification_helper":{"purl":"pkg:oci/system?repository_url=registry.redhat.io/3scale-amp24/system"}}},{"category":"product_version","name":"3scale-amp24/zync","product":{"name":"3scale-amp24/zync","product_id":"3scale-amp24/zync","product_identification_helper":{"purl":"pkg:oci/zync?repository_url=registry.redhat.io/3scale-amp24/zync"}}},{"category":"product_version","name":"3scale-amp25/system","product":{"name":"3scale-amp25/system","product_id":"3scale-amp25/system","product_identification_helper":{"purl":"pkg:oci/system?repository_url=registry.redhat.io/3scale-amp25/system"}}},{"category":"product_version","name":"3scale-amp25/zync","product":{"name":"3scale-amp25/zync","product_id":"3scale-amp25/zync","product_identification_helper":{"purl":"pkg:oci/zync?repository_url=registry.redhat.io/3scale-amp25/zync"}}},{"category":"product_version","name":"3scale-amp26/system","product":{"name":"3scale-amp26/system","product_id":"3scale-amp26/system","product_identification_helper":{"purl":"pkg:oci/system?repository_url=registry.redhat.io/3scale-amp26/system"}}},{"category":"product_version","name":"3scale-amp26/zync","product":{"name":"3scale-amp26/zync","product_id":"3scale-amp26/zync","product_identification_helper":{"purl":"pkg:oci/zync?repository_url=registry.redhat.io/3scale-amp26/zync"}}},{"category":"product_version","name":"3scale-amp2/system-rhel7","product":{"name":"3scale-amp2/system-rhel7","product_id":"3scale-amp2/system-rhel7","product_identification_helper":{"purl":"pkg:oci/system-rhel7?repository_url=registry.redhat.io/3scale-amp2/system-rhel7"}}},{"category":"product_version","name":"3scale-amp2/system-rhel8","product":{"name":"3scale-amp2/system-rhel8","product_id":"3scale-amp2/system-rhel8","product_identification_helper":{"purl":"pkg:oci/system-rhel8?repository_url=registry.redhat.io/3scale-amp2/system-rhel8"}}},{"category":"product_version","name":"3scale-amp2/system-rhel9","product":{"name":"3scale-amp2/system-rhel9","product_id":"3scale-amp2/system-rhel9","product_identification_helper":{"purl":"pkg:oci/system-rhel9?repository_url=registry.redhat.io/3scale-amp2/system-rhel9"}}},{"category":"product_version","name":"3scale-amp2/zync-rhel7","product":{"name":"3scale-amp2/zync-rhel7","product_id":"3scale-amp2/zync-rhel7","product_identification_helper":{"purl":"pkg:oci/zync-rhel7?repository_url=registry.redhat.io/3scale-amp2/zync-rhel7"}}},{"category":"product_version","name":"3scale-amp2/zync-rhel8","product":{"name":"3scale-amp2/zync-rhel8","product_id":"3scale-amp2/zync-rhel8","product_identification_helper":{"purl":"pkg:oci/zync-rhel8?repository_url=registry.redhat.io/3scale-amp2/zync-rhel8"}}},{"category":"product_version","name":"3scale-amp2/zync-rhel9","product":{"name":"3scale-amp2/zync-rhel9","product_id":"3scale-amp2/zync-rhel9","product_identification_helper":{"purl":"pkg:oci/zync-rhel9?repository_url=registry.redhat.io/3scale-amp2/zync-rhel9"}}},{"category":"product_version","name":"rubygem-activestorage.src","product":{"name":"rubygem-activestorage.src","product_id":"rubygem-activestorage.src","product_identification_helper":{"purl":"pkg:rpm/redhat/rubygem-activestorage?arch=src"}}},{"category":"product_version","name":"satellite:el8/rubygem-activestorage.src","product":{"name":"satellite:el8/rubygem-activestorage.src","product_id":"satellite:el8/rubygem-activestorage.src","product_identification_helper":{"purl":"pkg:rpm/redhat/rubygem-activestorage?arch=src&rpmmod=satellite:el8"}}}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"3scale-amp2/system-rhel7 as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel7"},"product_reference":"3scale-amp2/system-rhel7","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp2/system-rhel8 as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8"},"product_reference":"3scale-amp2/system-rhel8","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp2/system-rhel9 as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9"},"product_reference":"3scale-amp2/system-rhel9","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp2/zync-rhel7 as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel7"},"product_reference":"3scale-amp2/zync-rhel7","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp2/zync-rhel8 as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel8"},"product_reference":"3scale-amp2/zync-rhel8","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp2/zync-rhel9 as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9"},"product_reference":"3scale-amp2/zync-rhel9","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp20/system as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp20/system"},"product_reference":"3scale-amp20/system","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp21/system as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp21/system"},"product_reference":"3scale-amp21/system","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp21/zync as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp21/zync"},"product_reference":"3scale-amp21/zync","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp22/system as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp22/system"},"product_reference":"3scale-amp22/system","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp22/zync as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp22/zync"},"product_reference":"3scale-amp22/zync","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp24/system as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp24/system"},"product_reference":"3scale-amp24/system","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp24/zync as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp24/zync"},"product_reference":"3scale-amp24/zync","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp25/system as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp25/system"},"product_reference":"3scale-amp25/system","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp25/zync as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp25/zync"},"product_reference":"3scale-amp25/zync","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp26/system as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp26/system"},"product_reference":"3scale-amp26/system","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"3scale-amp26/zync as a component of Red Hat 3scale API Management Platform 2","product_id":"red_hat_3scale_api_management_platform_2:3scale-amp26/zync"},"product_reference":"3scale-amp26/zync","relates_to_product_reference":"red_hat_3scale_api_management_platform_2"},{"category":"default_component_of","full_product_name":{"name":"rubygem-activestorage.src as a component of Red Hat Satellite 6","product_id":"red_hat_satellite_6:rubygem-activestorage.src"},"product_reference":"rubygem-activestorage.src","relates_to_product_reference":"red_hat_satellite_6"},{"category":"default_component_of","full_product_name":{"name":"satellite:el8/rubygem-activestorage.src as a component of Red Hat Satellite 6","product_id":"red_hat_satellite_6:satellite:el8/rubygem-activestorage.src"},"product_reference":"satellite:el8/rubygem-activestorage.src","relates_to_product_reference":"red_hat_satellite_6"}]},"vulnerabilities":[{"cve":"CVE-2026-66066","cwe":{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"},"discovery_date":"2026-07-30T19:01:27.164363+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel7","red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8","red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel7","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel8","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9","red_hat_3scale_api_management_platform_2:3scale-amp20/system","red_hat_3scale_api_management_platform_2:3scale-amp21/system","red_hat_3scale_api_management_platform_2:3scale-amp21/zync","red_hat_3scale_api_management_platform_2:3scale-amp22/system","red_hat_3scale_api_management_platform_2:3scale-amp22/zync","red_hat_3scale_api_management_platform_2:3scale-amp24/system","red_hat_3scale_api_management_platform_2:3scale-amp24/zync","red_hat_3scale_api_management_platform_2:3scale-amp25/system","red_hat_3scale_api_management_platform_2:3scale-amp25/zync","red_hat_3scale_api_management_platform_2:3scale-amp26/system","red_hat_3scale_api_management_platform_2:3scale-amp26/zync","red_hat_satellite_6:rubygem-activestorage.src","red_hat_satellite_6:satellite:el8/rubygem-activestorage.src"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2509559"}],"notes":[{"category":"description","text":"A flaw was found in Active Storage, a component of Action Pack. An unauthenticated attacker can exploit this vulnerability by crafting a malicious file upload. This allows the attacker to invoke unsafe `libvips` operations, leading to the ability to read arbitrary files on the system including sensitive environment variables and application secrets. The exposure of these credentials could enable remote code execution or lateral movement within the affected system.","title":"Vulnerability description"},{"category":"summary","text":"activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations","title":"Vulnerability summary"},{"category":"other","text":"This Important flaw in Active Storage allows unauthenticated remote attackers to read arbitrary files and potentially achieve remote code execution. This occurs in applications configured with `libvips` as the Active Storage variant processor (a default since Rails 7.0) that accept untrusted image uploads.\n\nRed Hat Satellite: The Active Storage engine is explicitly commented out and disabled at runtime across all Satellite/Foreman builds. Furthermore, libvips dependencies are not shipped marking Red Hat Satellite as Not Affected.\n\nRed Hat 3scale: Neither the libvips binary nor its shared libraries are present in any 3scale container image, hence 3scale product is not affected.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"known_not_affected":["red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel7","red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8","red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel7","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel8","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9","red_hat_3scale_api_management_platform_2:3scale-amp20/system","red_hat_3scale_api_management_platform_2:3scale-amp21/system","red_hat_3scale_api_management_platform_2:3scale-amp21/zync","red_hat_3scale_api_management_platform_2:3scale-amp22/system","red_hat_3scale_api_management_platform_2:3scale-amp22/zync","red_hat_3scale_api_management_platform_2:3scale-amp24/system","red_hat_3scale_api_management_platform_2:3scale-amp24/zync","red_hat_3scale_api_management_platform_2:3scale-amp25/system","red_hat_3scale_api_management_platform_2:3scale-amp25/zync","red_hat_3scale_api_management_platform_2:3scale-amp26/system","red_hat_3scale_api_management_platform_2:3scale-amp26/zync","red_hat_satellite_6:rubygem-activestorage.src","red_hat_satellite_6:satellite:el8/rubygem-activestorage.src"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-66066"},{"category":"external","summary":"RHBZ#2509559","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509559"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-66066","url":"https://www.cve.org/CVERecord?id=CVE-2026-66066"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-66066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66066"},{"category":"external","summary":"http://www.openwall.com/lists/oss-security/2026/07/29/9","url":"http://www.openwall.com/lists/oss-security/2026/07/29/9"},{"category":"external","summary":"https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e","url":"https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e"},{"category":"external","summary":"https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5","url":"https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5"},{"category":"external","summary":"https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a","url":"https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a"},{"category":"external","summary":"https://github.com/rails/rails/releases/tag/v7.2.3.2","url":"https://github.com/rails/rails/releases/tag/v7.2.3.2"},{"category":"external","summary":"https://github.com/rails/rails/releases/tag/v8.0.5.1","url":"https://github.com/rails/rails/releases/tag/v8.0.5.1"},{"category":"external","summary":"https://github.com/rails/rails/releases/tag/v8.1.3.1","url":"https://github.com/rails/rails/releases/tag/v8.1.3.1"},{"category":"external","summary":"https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm","url":"https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm"},{"category":"external","summary":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml"},{"category":"external","summary":"https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html","url":"https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html"}],"release_date":"2026-07-30T18:32:11.419000+00:00","scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"products":["red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel7","red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8","red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel7","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel8","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9","red_hat_3scale_api_management_platform_2:3scale-amp20/system","red_hat_3scale_api_management_platform_2:3scale-amp21/system","red_hat_3scale_api_management_platform_2:3scale-amp21/zync","red_hat_3scale_api_management_platform_2:3scale-amp22/system","red_hat_3scale_api_management_platform_2:3scale-amp22/zync","red_hat_3scale_api_management_platform_2:3scale-amp24/system","red_hat_3scale_api_management_platform_2:3scale-amp24/zync","red_hat_3scale_api_management_platform_2:3scale-amp25/system","red_hat_3scale_api_management_platform_2:3scale-amp25/zync","red_hat_3scale_api_management_platform_2:3scale-amp26/system","red_hat_3scale_api_management_platform_2:3scale-amp26/zync","red_hat_satellite_6:rubygem-activestorage.src","red_hat_satellite_6:satellite:el8/rubygem-activestorage.src"]}],"threats":[{"category":"impact","details":"Important","product_ids":["red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel7","red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8","red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel9","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel7","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel8","red_hat_3scale_api_management_platform_2:3scale-amp2/zync-rhel9","red_hat_3scale_api_management_platform_2:3scale-amp20/system","red_hat_3scale_api_management_platform_2:3scale-amp21/system","red_hat_3scale_api_management_platform_2:3scale-amp21/zync","red_hat_3scale_api_management_platform_2:3scale-amp22/system","red_hat_3scale_api_management_platform_2:3scale-amp22/zync","red_hat_3scale_api_management_platform_2:3scale-amp24/system","red_hat_3scale_api_management_platform_2:3scale-amp24/zync","red_hat_3scale_api_management_platform_2:3scale-amp25/system","red_hat_3scale_api_management_platform_2:3scale-amp25/zync","red_hat_3scale_api_management_platform_2:3scale-amp26/system","red_hat_3scale_api_management_platform_2:3scale-amp26/zync","red_hat_satellite_6:rubygem-activestorage.src","red_hat_satellite_6:satellite:el8/rubygem-activestorage.src"]}],"title":"activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations"}]}