CVE-2021-33564: Dragonfly Ruby gem argument injection via crafted URL

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and a very high EPSS score plus public exploit tooling make this a top remediation priority.

What it is

The Dragonfly gem before 1.4.0 for Ruby mishandles the ImageMagick convert utility in its generate and process features, allowing argument injection through a crafted URL when the verify_url option is disabled. This lets a remote attacker read and write arbitrary files, which may escalate to code execution. The flaw is rated critical and affects any application exposing Dragonfly processing to untrusted input.

Impact

An attacker can read and write arbitrary files on the host and potentially achieve code execution. This undermines confidentiality, integrity and availability of the affected application and its data.

Attack surface

Reachable over the network through a crafted URL passed to Dragonfly's generate or process features, with no authentication or user interaction required per the CVSS vector. The verify_url option must be disabled for the injection to succeed.

Exploitation

Not listed in CISA KEV, but EPSS is very high at roughly 0.72 (99th percentile) and public exploit references, including a Nuclei template and a proof-of-concept repository, are available. Active exploitation is plausible given the exposed attack surface and available tooling.

What to do

• Upgrade the Dragonfly gem to version 1.4.0 or later, which contains the patch.
• If immediate upgrade is not possible, enable the verify_url option to block crafted URLs.
• Avoid passing untrusted user input into Dragonfly generate or process calls.
• Restrict outbound and filesystem access for the Ruby process running Dragonfly to limit impact.
• Monitor for unexpected ImageMagick convert invocations spawned by the application.

Detection

• Search application and web logs for crafted URLs containing ImageMagick convert arguments or unusual file paths.
• Monitor process creation for convert commands spawned by the Ruby application with unexpected arguments.
• Use the public Nuclei template for CVE-2021-33564 to scan exposed instances.
• Alert on unexpected file reads or writes in directories accessible to the Dragonfly process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.