← Back to context

Comment by comrade1234

10 hours ago

Do you have to have matlab running on your rails server for this to happen?

7 comments

comrade1234

Reply
bradly  10 hours ago

Not running, but supported. You can check your app with:

    bin/rails runner '
      require "vips"
      puts "ruby-vips #{Vips::VERSION}  libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}"
      begin
        Vips::Operation.new("matload")
        puts "matload PRESENT - this build can reach libmatio"
      rescue Vips::Error
        puts "matload ABSENT - this build cannot reach libmatio"
      end
    '

This is from the Rails official docs for the CVE which, interestingly, they only released as an agent skill. https://github.com/rails/rails-forensics-CVE-2026-66066/blob...

  • XenoCyber0  4 hours ago

    An agent skill is the official distribution format for the forensics on a 9.5. I mean, I get it, anyone running a Rails app right now is pasting "am I affected" into an agent anyway, but it's the kind of thing that would've sounded like a joke a couple years ago.

  • comrade1234  5 hours ago

    Why would you have matlab on an external server? People don't even have a compiler on the server in this situation. Crazy.

rietta  10 hours ago

I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.

  • kawsper  10 hours ago

    libvips also have a block_untrusted mode where it will block unsafe loaders, .mat seems to be marked as untrusted:

        vips -l
    VipsForeignLoadMat (matload), load mat from file (.mat), priority=0, untrusted, is_a, get_flags, get_flags_filename, header, load

    • rietta  9 hours ago

      Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.