CVE-2026-23885

CVE-2026-23885 is a medium-severity vulnerability in Alchemy-cms Alchemy Cms with a CVSS 3.x base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-95.

Key facts

Description

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.

Frequently asked questions

What is CVE-2026-23885?
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.
How severe is CVE-2026-23885?
CVE-2026-23885 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-23885 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-23885?
CVE-2026-23885 affects Alchemy-cms Alchemy Cms. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-23885?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-23885 have an EU (EUVD) identifier?
Yes. CVE-2026-23885 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-3281.
When was CVE-2026-23885 published?
CVE-2026-23885 was published on 2026-01-19 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Alchemy-cms Alchemy Cms

All CVEs affecting Alchemy-cms Alchemy Cms →

Other CWE-95 (Eval Injection) vulnerabilities

Browse all CWE-95 (Eval Injection) vulnerabilities →