Ruby on Rails Vulnerability in Alchemy CMS Affects Multiple Versions
CVE-2026-23885
What is CVE-2026-23885?
Alchemy CMS, an open-source content management system built with Ruby on Rails, contains a significant vulnerability in versions prior to 7.4.12 and 8.0.3. An issue arises from the use of the Ruby eval() function within the resource_url_proxy method, which executes user-defined strings based on the engine_name attribute. This implementation choice, marked with a bypass of security linting, exposes the system to potential remote code execution by authenticated attackers. By manipulating the engine_name sourced from administrative configurations, attackers could escape the Ruby sandbox environment and execute arbitrary commands on the host operating system. Mitigations in recent versions have replaced the insecure eval() function with a safer send() method.
Affected Version(s)
alchemy_cms < 7.4.12 < 7.4.12
alchemy_cms >= 8.0.0.a, < 8.0.3 < 8.0.0.a, 8.0.3