CVE-2026-23885: Alchemy CMS RCE Vulnerability

CVE-2026-23885 Overview

CVE-2026-23885 is a Code Injection vulnerability affecting Alchemy CMS, an open source content management system engine written in Ruby on Rails. The vulnerability exists in the Alchemy::ResourcesHelper#resource_url_proxy method where the application uses Ruby's dangerous eval() function to dynamically execute strings sourced from the resource_handler.engine_name attribute. This allows an authenticated attacker with administrative privileges to escape the Ruby sandbox and execute arbitrary system commands on the underlying host operating system.

Critical Impact

Authenticated attackers with administrative access can achieve remote code execution on the host system by manipulating module definitions that influence the engine_name attribute, potentially leading to complete system compromise.

Affected Products

• Alchemy CMS versions prior to 7.4.12
• Alchemy CMS versions prior to 8.0.3

Discovery Timeline

• 2026-01-19 - CVE CVE-2026-23885 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-23885

Vulnerability Analysis

The vulnerability is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), commonly known as Eval Injection. The flaw resides in the file app/helpers/alchemy/resources_helper.rb at line 28, where the code explicitly bypasses security linting with a # rubocop:disable Security/Eval comment, indicating that the developers were aware of the dangerous function usage but did not implement proper mitigations.

The attack requires local access and high privileges (administrative authentication), which limits the immediate attack surface. However, once an attacker gains administrative access to the Alchemy CMS interface, they can leverage this vulnerability to break out of the application context entirely and execute arbitrary commands at the operating system level with the privileges of the web server process.

Root Cause

The root cause is the use of Ruby's eval() function to process the engine_name attribute without adequate input validation or sanitization. The engine_name is sourced from module definitions that can be influenced by administrative configurations within the CMS. By crafting a malicious engine_name value containing Ruby code, an attacker can inject arbitrary commands that will be executed when the resource_url_proxy method processes the input.

Attack Vector

The attack vector is local with high complexity, requiring the attacker to first obtain authenticated administrative access to the Alchemy CMS instance. Once authenticated, the attacker can manipulate module definitions or configurations that influence the engine_name attribute. When the vulnerable resource_url_proxy method is invoked and processes this tainted input through eval(), the injected Ruby code executes within the application context.

The injected code can then leverage Ruby's system execution capabilities (such as backticks, system(), or exec()) to run arbitrary shell commands on the host operating system. This can lead to data exfiltration, installation of backdoors, lateral movement, or complete system compromise depending on the privileges of the Ruby on Rails application process.

Detection Methods for CVE-2026-23885

Indicators of Compromise

• Unusual or unexpected values in module configuration settings, particularly in engine_name attributes
• Web server process spawning unexpected child processes or making unusual system calls
• Log entries showing Ruby exceptions or errors related to eval execution in resources_helper.rb
• Evidence of command execution patterns in application logs (backticks, system calls, or shell commands)

Detection Strategies

• Monitor administrative configuration changes within Alchemy CMS for suspicious patterns
• Implement file integrity monitoring on Ruby application files, particularly app/helpers/alchemy/resources_helper.rb
• Deploy application-level logging to capture all administrative actions and configuration modifications
• Use runtime application self-protection (RASP) solutions to detect eval injection attempts

Monitoring Recommendations

• Configure alerts for any process spawned by the Ruby/Rails web server process that is not part of normal operations
• Enable verbose logging for administrative actions within the CMS
• Monitor for network connections initiated by the web application process to unexpected destinations
• Review authentication logs for unauthorized administrative access attempts

How to Mitigate CVE-2026-23885

Immediate Actions Required

• Upgrade Alchemy CMS to version 7.4.12 or 8.0.3 immediately
• Review administrative user accounts and remove unnecessary elevated privileges
• Audit recent administrative configuration changes for signs of exploitation
• Implement network segmentation to limit the impact of potential compromise

Patch Information

The Alchemy CMS maintainers have addressed this vulnerability by replacing the dangerous eval() function with the safer send() method. Fixed versions are available:

• Version 7.4.12 - GitHub Release v7.4.12
• Version 8.0.3 - GitHub Release v8.0.3

For technical details on the fix, see the GitHub commit 55d03ec and GitHub commit 563c4ce. Additional information is available in the GitHub Security Advisory GHSA-2762-657x-v979.

Workarounds

• Restrict administrative access to trusted users only until patching is complete
• Implement Web Application Firewall (WAF) rules to detect and block suspicious input patterns
• Deploy network segmentation to isolate the CMS server from critical infrastructure
• Enable enhanced logging and monitoring to detect potential exploitation attempts

# Upgrade Alchemy CMS to patched version
bundle update alchemy_cms

# Verify installed version
bundle show alchemy_cms

# For version 7.x branch, ensure version is 7.4.12 or later
# For version 8.x branch, ensure version is 8.0.3 or later