PT-2026-3507 · Alchemy · Alchemy

Thedeepopc · Published 2026-01-19 · Updated 2026-01-22 · CVE-2026-23885

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alchemy versions prior to 7.4.12 Alchemy versions prior to 8.0.3

Description Alchemy, a Ruby on Rails content management system, allows an authenticated attacker to execute arbitrary system commands on the host operating system. The application utilizes the Ruby eval() function to dynamically execute a string sourced from the resource handler.engine name attribute within the Alchemy::ResourcesHelper#resource url proxy method, located in app/helpers/alchemy/resources helper.rb at line 28. The use of eval() bypasses security linting, and the engine name attribute is influenced by administrative configurations, enabling the execution of arbitrary code.

Recommendations Update to Alchemy version 7.4.12 or later. Update to Alchemy version 8.0.3 or later.

Exploit

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-23885

GHSA-2762-657X-V979

Affected Products

Alchemy

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23885.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/alchemy_cms/CVE-2026-23885.yml · Exploit
• https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7 · Patch
• https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26 · Patch
• https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2762-657x-v979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23885 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23885 · Vendor Advisory
• https://github.com/AlchemyCMS/alchemy_cms · Note
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3 · Note
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12 · Note
• https://twitter.com/_cvereports/status/2013900326479278437 · Twitter Post
• https://twitter.com/pulsepatchio/status/2014347353692443016 · Twitter Post
• https://t.me/cveNotify/149399 · Telegram Post
• https://twitter.com/CVEnew/status/2013364756309254527 · Twitter Post