Re-enable SVG after Rails blocks untrusted libvips loaders

I patched Virtualtrails for GHSA-xr9x-r78c-5hrm (CVE-2026-66066), the Active Storage arbitrary file read via libvips. The fix has Active Storage call Vips.block_untrusted(true) at boot, which turns off libvips loaders marked “unfuzzed” (unsafe for untrusted content).

That includes SVG. On Virtualtrails I render share cards as SVG and convert them to PNG with libvips. After the upgrade, that conversion failed with a “not in a known format” error because the SVG loader was blocked.

You don’t have to turn untrusted loaders back on wholesale. You can re-enable just the ones you need in an initializer. Active Storage blocks them before initializers run, so this runs afterwards:

# config/initializers/vips.rb
# Keep Magick and other untrusted loaders blocked.
Vips.block("VipsForeignLoadSvg", false)

That restores SVG for my app-generated share cards without reopening the ImageMagick path (VipsForeignLoadMagick / VipsForeignLoadMagick7). Magick is the one Rails warns about in particular: on many platforms it handles a lot more than BMP/ICO/PSD, so unblocking it is a much larger attack surface.

This only makes sense when the SVG is trusted (mine is generated by the app). Don’t do this for user-uploaded SVGs without other hardening. For the advisory itself, including secret rotation guidance, see GHSA-xr9x-r78c-5hrm.