Alchemy CMS RCE: Ruby Eval Flaw Opens Door for Command Execution

CVE Notify is flagging a critical remote code execution (RCE) vulnerability, CVE-2026-23885, impacting the Alchemy open-source content management system (CMS) engine. The issue stems from the use of Ruby’s eval() function within the Alchemy::ResourcesHelper#resource_url_proxy method. Prior to versions 7.4.12 and 8.0.3, this function dynamically executed code based on the resource_handler.engine_name attribute. What’s particularly concerning is that the code explicitly bypasses security checks with a # rubocop:disable Security/Eval comment, signaling that the developers were aware of the risky function’s use but failed to implement adequate safeguards.

According to CVE Notify, this vulnerability allows an authenticated attacker to break out of the Ruby sandbox and execute arbitrary system commands. The engine_name attribute can be influenced by administrative configurations, providing a pathway for exploitation. The fix in versions 7.4.12 and 8.0.3 involves replacing the dangerous eval() call with a safer send() method, mitigating the risk of command injection.