CVE-2026-23885 AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby eval function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelperresourceurlproxy. Th...

CVE-2026-23885

creationtimestamp| type| source ---|---|--- 2026-01-19 10:25:43+00:00| published-proof-of-concept| https://github.com/AlchemyCMS/alchemycms/security/advisories/GHSA-2762-657x-v979 2026-01-19 22:09:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcsnscsec22m 2026-01-20...