CVE-2026-23885

Security Advisory: CVE-2026-23885 Authenticated Remote Code Execution RCE in AlchemyCMS 1. Executive Summary A critical security vulnerability involving Improper Neutralization of Directives in Dynamically Evaluated Code CWE-95 was discovered in the AlchemyCMS framework. The vulnerability allows...

AlchemyCMS Authenticated eval() RCE

Authenticated Remote Code Execution RCE via unsafe eval in resourceurlproxy helper. The helper method Alchemy::ResourcesHelperresourceurlproxy in app/helpers/alchemy/resourceshelper.rb insecurely processes the enginename attribute from a resourcehandler object, passing it directly to Ruby eval...

CVE-2026-23885

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby "eval" function to dynamically execute a string provided by the "resourcehandler.enginename" attribute in...