CVE-2022-21831: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days.

A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.

Affected products

• Debian Debian Linux: version 10.0 only
• Rubyonrails Active Storage: from 5.2.0, before 5.2.6.3 (fixed in 5.2.6.3); from 6.0.0, before 6.0.4.7 (fixed in 6.0.4.7); from 6.1.0, before 6.1.4.7 (fixed in 6.1.4.7); from 7.0.0, before 7.0.2.3 (fixed in 7.0.2.3)

Published 2022-05-26. Last modified 2026-06-17.