Project
Open-source, low-memory image processing library with many format loaders, used via sharp in Node.js and as the Vips processor in Rails Active Storage.
Satori, the JSX-to-SVG step behind Next.js next/og, put external input into SVG unescaped, per a dev.to explainer of CVE-2026-94545. The explainer says code execution would need the injected SVG to corrupt memory in a native parser, while SSRF needs only the injection.
Reality
The probes read Langflow's secret key file and grep the process environment for OpenAI and AWS credentials, which puts an AI orchestration tool on the same scanning clock as the Rails file-read bug of the same week.
Perspective Coverage
4 publishersReality
Rapid7 reproduced the Active Storage arbitrary file read on five Rails versions, then walked it through leaked signing material into remote code execution. Any app on 7.0 defaults taking untrusted uploads is a patch-now case.
Reality
Rails shipped fixes on July 29 in 7.2.3.2, 8.0.5.1 and 8.1.3.1. Whether your app is actually closed depends on the libvips version sitting on the host and on which features serve a processed image back to the uploader.
Reality
A wallpaper site's post-mortem on serving 70,000-plus 4K masters through Next.js 15 shows the optimizer failing on Referer checks and edge CPU ceilings, not on throughput.
Reality