CVE-2026-23885
Unknown Unknown - Not Provided
Arbitrary Code Execution via Eval in Alchemy CMS Resource Helper

Publication date: 2026-01-19

Last updated on: 2026-04-09

Assigner: GitHub, Inc.

Description
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-19
Last Modified
2026-04-09
Generated
2026-05-07
AI Q&A
2026-01-20
EPSS Evaluated
2026-05-05
NVD
CVE-2026-23885
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
alchemy-cms alchemy_cms to 7.4.12 (exc)
alchemy-cms alchemy_cms From 8.0.0 (inc) to 8.0.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Alchemy content management system where the Ruby eval() function is used to execute a string from the resource_handler.engine_name attribute. Because engine_name can be influenced by administrative configurations, an authenticated attacker can exploit this to execute arbitrary system commands on the host operating system. The issue is due to unsafe use of eval() which bypasses security linting, allowing escape from the Ruby sandbox.


How can this vulnerability impact me? :

An attacker with administrative access can execute arbitrary system commands on the host OS, potentially leading to full system compromise, data loss, or unauthorized control over the server running Alchemy.


What immediate steps should I take to mitigate this vulnerability?

Upgrade Alchemy to version 7.4.12 or 8.0.3 or later, as these versions replace the vulnerable use of Ruby eval() with a safer send() method, thereby mitigating the vulnerability.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart