Bill Mill on Nostr: The vector for us was that somebody uploaded a file with a jpg extension that was ...

The vector for us was that somebody uploaded a file with a jpg extension that was actually an EPS (postscript) file. A javascript library passed the image to imagemagick, which detected it as a postscript file and passed it off to ghostscript (we had no idea it would do this), which then happily gave shell to the attacker. madness