TI-2022-08535 Aliases CVE-2022-24720 GHSA-cxf7-qrc5-9446

Improper Input Validation in image_processing

HIGH 82CWE-20Published 2022-03-01 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.02686 85th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed image_processing (janko): 1.12.2image_processing (RubyGems): 1.12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
janko	image_processing	before 1.12.2	1.12.2	Patch available	CNA
—	image_processing (RubyGems)	before 1.12.2	1.12.2	Patch available	GHSA-cxf7-qrc5-9446

image_processing Vendorjanko Affected before 1.12.2 Fixed in 1.12.2 Patch available CNA
image_processing (RubyGems) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-cxf7-qrc5-9446

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:image_processing_project:image_processing::::::ruby::*	before 1.12.2	Vulnerable	Image Processing Project
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian

cpe:2.3:a:image_processing_project:image_processing:*:*:*:*:*:ruby:*:* Versions before 1.12.2 Vulnerable ·Image Processing Project
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Fix · CNA image_processing (janko) Fixed in 1.12.2
Fix · GHSA-cxf7-qrc5-9446 image_processing (RubyGems) Fixed in 1.12.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-24720
2026-10-03 Alias added: GHSA-cxf7-qrc5-9446

References

Exploit 1

https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446

Patch 1

https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences