diff --git a/app/helpers/advertisement_helper.rb b/app/helpers/advertisement_helper.rb
index ed0bb2763..39aeea392 100644
--- a/app/helpers/advertisement_helper.rb
+++ b/app/helpers/advertisement_helper.rb
@@ -91,7 +91,7 @@ def community_icon(icon_path)
       icon = Magick::ImageList.new("./app/assets/images/#{File.basename(expanded_path)}")
     else
       icon = Magick::ImageList.new
-      icon_path_content = URI.open(icon_path).read # rubocop:disable Security/Open
+      icon_path_content = URI.parse(icon_path).open.read
       icon.from_blob(icon_path_content)
     end
 
diff --git a/test/helpers/advertisement_helper_test.rb b/test/helpers/advertisement_helper_test.rb
index e418e9971..6c0aa2c95 100644
--- a/test/helpers/advertisement_helper_test.rb
+++ b/test/helpers/advertisement_helper_test.rb
@@ -7,6 +7,8 @@ class AdvertisementHelperTest < ActionView::TestCase
   setup do
     @external_png = File.open(Rails.root.join('app/assets/images/logo.png'))
     stub_request(:get, 'https://example.com/external.png').to_return(body: @external_png)
+
+    FileUtils.rm_f(command_execution_test_filepath)
   end
 
   teardown do
@@ -24,4 +26,16 @@ class AdvertisementHelperTest < ActionView::TestCase
     icon = community_icon('https://example.com/external.png')
     assert icon.is_a?(Magick::ImageList)
   end
+
+  test ':community_icon should not allow system command execution' do
+    community_icon('| touch "tmp/oops.txt"')
+
+    assert_not File.exist?(command_execution_test_filepath)
+  end
+
+  private
+
+  def command_execution_test_filepath
+    Rails.root.join('tmp/oops.txt')
+  end
 end