AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

🗓️ 21 Jan 2026 01:04:32Reported by GitHub Advisory DatabaseType

Authenticated RCE via eval in ResourcesHelper using engine_name; admin config access required.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-23885	19 Jan 202621:09	–	attackerkb
Circl	CVE-2026-23885	19 Jan 202610:25	–	circl
CNNVD	AlchemyCMS security vulnerabilities	19 Jan 202600:00	–	cnnvd
CVE	CVE-2026-23885	19 Jan 202621:09	–	cve
Cvelist	CVE-2026-23885 AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper	19 Jan 202621:09	–	cvelist
EUVD	EUVD-2026-3281	19 Jan 202621:09	–	euvd
NVD	CVE-2026-23885	19 Jan 202622:16	–	nvd
OSV	CVE-2026-23885 AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper	19 Jan 202621:09	–	osv
OSV	GHSA-2762-657X-V979 AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper	21 Jan 202601:04	–	osv
Positive Technologies	PT-2026-3507	19 Jan 202600:00	–	ptsecurity

Vulners

Node

alchemy-cms alchemy_cmsRange8.0.0.a–8.0.3rubygems

Source	Link
github	www.github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-23885
github	www.github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26
github	www.github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7
github	www.github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12
github	www.github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/alchemy_cms/CVE-2026-23885.yml
github	www.github.com/advisories/GHSA-2762-657x-v979

02 Feb 2026 14:45Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.4 - 9.9

EPSS0.00024

SSVC