CVE-2026-66066: Rails avatar upload reads /proc/self/environ

Ruby on Rails vulnerability CVE-2026-66066, scored 9.5, lets an image upload read /proc/self/environ when Active Storage uses libvips older than 8.13, exposing SECRET_KEY_BASE. That enables forged signed variant parameters and command execution. Fixes are Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1 plus Vips.block_untrusted = true.

• Affects Rails 7.0+ apps using Active Storage with vips as variant processor
• An HDF5 external file reference reads /proc/self/environ and SECRET_KEY_BASE
• Fixes: Rails 7.2.3.2, 8.0.5.1, 8.1.3.1 and Vips.block_untrusted = true
• SECRET_KEY_BASE must be rotated after upgrading, or the stolen key stays valid