CVE-2022-24720 Improper Input Validation in image_processing

Critical 9.8 Published 1 Mar 2022 Updated 22 Apr 2025

Attackers can execute shell commands via unsanitized user input in image_processing operations, affecting Active Storage users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-24720?

CVE-2022-24720 is a critical command injection vulnerability in Debian Debian Linux, published on 1 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Weakness: CWE-20

Which versions are affected by CVE-2022-24720?

2 open source packages ship an affected version, including image_processing. It affects 2 products.

Package	Affected	Fixed in
`image_processing` RubyGems	All versions	`1.12.2`
`image_processing` RubyGems	All versions	`1.12.2`

Products include Debian Debian Linux, Image Processing Project Image Processing.

How do I fix CVE-2022-24720?

Upgrade image_processing to 1.12.2 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-24720 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24720 exists.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-24720, DSA-5310-1, GHSA-cxf7-qrc5-9446, UBUNTU-CVE-2022-24720, USN-6675-1.