[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":54,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":61,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":67,"vulnerability-29733":74},[4,15,21,27,33,39,44],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[11],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":16,"slug":17,"text":18,"link":8,"external":9,"targets":19,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[20],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":22,"slug":23,"text":24,"link":8,"external":9,"targets":25,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[26],"\u002Ffeatures\u002Fpentest-reporting",{"title":28,"slug":29,"text":30,"link":8,"external":9,"targets":31,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[32],"\u002Ffeatures\u002Fintegrations",{"title":34,"slug":35,"text":36,"link":8,"external":9,"targets":37,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[38],"\u002Fexploit-helpers\u002Fsniper",{"title":40,"slug":14,"text":41,"link":8,"external":9,"targets":42,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Homepage","Turn confirmed vulnerabilities into evidence your auditor accepts. Testing requirements for DORA, NIS2, SOC 2, ISO 27001, and CRA.",[43],"\u002F",{"title":45,"slug":46,"text":47,"link":48,"external":49,"targets":50,"cta":53,"variant":13,"campaign_id":46},"Office Hours #11 - Compliance cycle survey","office-hours-11","[Live Office Hours, Wed Sept 16] Continuous compliance evidence: from automated tools or tired humans?","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_FLMs2-vyQbCTB67guMJH-Q",true,[51,52],"\u002Finsights\u002Fcompliance-cycles-survey","\u002Finsights","Save your spot",["Island",55],{"key":56,"params":57,"result":59},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":58},"{}",{"head":60},{},["Island",62],{"key":63,"params":64,"result":65},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":58},{"head":66},{},["Island",68],{"key":69,"params":70,"result":72},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":71},"{\"text-color\":\"gray\"}",{"head":73},{},{"id":75,"detectable_with":76,"vuln_details":82,"vuln_id":106,"name":107,"published":108,"updated":108},29733,{"tool":77,"engine":80},{"id":78,"name":79},1,"Network Scanner",{"id":78,"name":81},"Sniper",{"id":75,"codename":83,"description":84,"severity":85,"risk_description":86,"public_description":87,"public_recommendation":88,"recommendation":89,"references":90,"cvssv3":95,"epss_score":96,"epss_percentile":97,"cve":98,"in_cisa_catalog":9,"date":100,"software_type":101,"vendor":102,"product":103,"ptt_exploit_capabilities":104},"KindaRails2Shell","We found that the target Ruby on Rails server is vulnerable to CVE-2026-66066 (GHSA-xr9x-r78c-5hrm, nicknamed \"KindaRails2Shell\"), a type confusion vulnerability (CWE-1188) in Active Storage's libvips-based variant processing. By default, Active Storage lets libvips process untrusted, unfuzzed file formats; an attacker can upload a crafted MATLAB 5.0 \u002F HDF5 polyglot blob whose external-link dataset causes libvips to leak an arbitrary server-side file (e.g. \u002Fproc\u002Fself\u002Fenviron) back through the rendered image's pixel data. By leaking SECRET_KEY_BASE this way, an unauthenticated attacker can forge a signed Active Storage variation token carrying an instance_eval payload that Rails evaluates on deserialization, resulting in unauthenticated remote code execution in the context of the Rails process. Exploitation does not require user interaction.\nWe have detected this by uploading a crafted polyglot blob to leak SECRET_KEY_BASE from the target, then forging a variation token to execute the id command and retrieving its output back through the same file-read primitive.","critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Ruby on Rails Active Storage, when using the default libvips image variant processor, is vulnerable to CVE-2026-66066 (\"KindaRails2Shell\"), a type confusion vulnerability that lets an unauthenticated attacker read arbitrary files from the server and, by leaking the application's SECRET_KEY_BASE, forge a signed request that leads to remote code execution.","Update Ruby on Rails Active Storage to version 7.2.3.2, 8.0.5.1, 8.1.3.1 or later, and rotate SECRET_KEY_BASE and other application credentials.","We recommend updating the activestorage gem to version 7.2.3.2, 8.0.5.1, 8.1.3.1 or later, ensuring libvips is upgraded to version 8.13 or later, and rotating SECRET_KEY_BASE, the Rails master key, and any other credentials the application process could read, since they may already have been exposed.",[91,92,93,94],"https:\u002F\u002Fgithub.com\u002Frails\u002Frails\u002Fsecurity\u002Fadvisories\u002FGHSA-xr9x-r78c-5hrm","https:\u002F\u002Fdiscuss.rubyonrails.org\u002Ft\u002Fcve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing\u002F91432","https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F07\u002F29\u002F9","https:\u002F\u002Fadvisories.gitlab.com\u002Fgem\u002Factivestorage\u002FCVE-2026-66066\u002F",10,0.27861,0.97982,[99],"CVE-2026-66066","2026-07-29T00:00:00Z","Shared library","Rails","Active Storage",[105],"RCE","NETSCAN-SNIPER-CVE-2026-66066","Ruby on Rails Active Storage - Remote Code Execution","2026-09-15T00:00:00Z"]