PT-2026-3507 · Alchemy · Alchemy

Thedeepopc · Publicado 2026-01-19 · Atualizado 2026-01-22 · CVE-2026-23885

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alchemy versions prior to 7.4.12 Alchemy versions prior to 8.0.3

Description Alchemy, a Ruby on Rails content management system, allows an authenticated attacker to execute arbitrary system commands on the host operating system. The application utilizes the Ruby eval() function to dynamically execute a string sourced from the resource handler.engine name attribute within the Alchemy::ResourcesHelper#resource url proxy method, located in app/helpers/alchemy/resources helper.rb at line 28. The use of eval() bypasses security linting, and the engine name attribute is influenced by administrative configurations, enabling the execution of arbitrary code.

Recommendations Update to Alchemy version 7.4.12 or later. Update to Alchemy version 8.0.3 or later.

Exploit

Correção

RCE

Eval Injection

Enumeração de Fraquezas

CWE-95

Identificadores relacionados

CVE-2026-23885

GHSA-2762-657X-V979

Produtos afetados

Alchemy

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23885.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/alchemy_cms/CVE-2026-23885.yml · Exploit
• https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7 · Correção
• https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26 · Correção
• https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979 · Aviso do Fabricante
• https://github.com/AlchemyCMS/alchemy_cms · Nota
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3 · Nota
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12 · Nota
• https://osv.dev/vulnerability/GHSA-2762-657x-v979 · Aviso do Fabricante
• https://twitter.com/_cvereports/status/2013900326479278437 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2014347353692443016 · Publicação no Twitter
• https://t.me/cveNotify/149399 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-23885 · Nota de Segurança
• https://twitter.com/CVEnew/status/2013364756309254527 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23885 · Aviso do Fabricante