AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

Summary A vulnerability was discovered during a manual security audit of the AlchemyCMS source code. The application uses the Ruby eval function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelperresourceurlproxy. Details The...

CVE-2026-23885

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby eval function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelperresourceurlproxy. Th...

Eval Injection

Overview Affected versions of this package are vulnerable to Eval Injection via the resourceurlproxy function. An attacker can execute arbitrary system commands by supplying crafted input to the enginename attribute, which is evaluated within the application context. PoC require 'ostruct' def...

EUVD-2026-3281

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby eval function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelperresourceurlproxy. Th...

CVE-2026-23885 AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby eval function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelperresourceurlproxy. Th...

CVE-2026-23885

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby eval function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelperresourceurlproxy. Th...

PT-2026-3507

Name of the Vulnerable Software and Affected Versions Alchemy versions prior to 7.4.12 Alchemy versions prior to 8.0.3 Description Alchemy, a Ruby on Rails content management system, allows an authenticated attacker to execute arbitrary system commands on the host operating system. The applicatio...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000729)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000729 advisory. Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entire...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001989)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001989 advisory. Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entire...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002410)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002410 advisory. Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entire...

EUVD-2001-0853

Malware in sbrugna...

EUVD-2001-0854

Malware in sbrugna...

EUVD-2023-0451

Malicious code in bioql PyPI...

EUVD-2025-29446

Malicious code in bioql PyPI...

Malicious code in alchemy-rg5mi-8o61m-gale-project (npm)

The package alchemy-rg5mi-8o61m-gale-project was found to contain malicious code...

Malicious code in glow-wds16-y23uq-alchemy-project (npm)

The package glow-wds16-y23uq-alchemy-project was found to contain malicious code...

Malicious code in kelp-mieow-7b9r2-alchemy-project (npm)

The package kelp-mieow-7b9r2-alchemy-project was found to contain malicious code...

Malicious code in gale-svtyl-d57z0-alchemy-project (npm)

The package gale-svtyl-d57z0-alchemy-project was found to contain malicious code...

MAL-2025-27954 Malicious code in nymph-j9yhw-pnwb0-alchemy-project (npm)

The package nymph-j9yhw-pnwb0-alchemy-project was found to contain malicious code...

MAL-2025-14277 Malicious code in alchemy-s89r2-1zvdy-lucid-project (npm)

The package alchemy-s89r2-1zvdy-lucid-project was found to contain malicious code...