AlchemyCMS alchemy_cms up to 7.4.11/8.0.2 resources_helper.rb eval eval injection

Summaryinfo

A vulnerability was found in AlchemyCMS alchemy_cms up to 7.4.11/8.0.2. It has been declared as problematic. Affected by this vulnerability is the function eval of the file app/helpers/alchemy/resources_helper.rb. Such manipulation leads to eval injection. This vulnerability is listed as CVE-2026-23885. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in AlchemyCMS alchemy_cms up to 7.4.11/8.0.2. Affected by this issue is the function eval of the file app/helpers/alchemy/resources_helper.rb. The manipulation with an unknown input leads to a eval injection vulnerability. Using CWE to declare the problem leads to CWE-95. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-23885 since 01/16/2026. The exploitation is known to be difficult. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 7.4.12 or 8.0.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 55d03ec600fd9e07faae1138b923790028917d26 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-3281). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• AlchemyCMS

Name

• alchemy_cms

Version

• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3
• 7.4.4
• 7.4.5
• 7.4.6
• 7.4.7
• 7.4.8
• 7.4.9
• 7.4.10
• 7.4.11
• 8.0.0
• 8.0.1
• 8.0.2

License

• open-source

Website

• Product: https://github.com/AlchemyCMS/alchemy_cms/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion