I use ruby-landlock as well for image processing. I can recommend setting VIPS_BLOCK_UNTRUSTED=1 when you switch to vips, it blocks untrusted image decoders.

Not setting that value caught the rails team off guard just recently, maybe it should be the default.