Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-57579 (GCVE-0-2026-57579)

Vulnerability from nvd – Published: 2026-09-14 16:54 – Updated: 2026-09-14 17:40

Title

Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

Summary

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 17:39 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root Scorecard

References

11 references

URL	Tags
https://github.com/AlchemyCMS/alchemy_cms/securit…	x_refsource_CONFIRM
https://github.com/AlchemyCMS/alchemy_cms/pull/3982	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
AlchemyCMS	alchemy_cms	Affected: < 7.4.15 Affected: >= 8.0.0, < 8.0.15 Affected: >= 8.1.0, < 8.1.14 Affected: >= 8.2.0, < 8.2.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57579",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T17:39:44.487415Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T17:40:12.109Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alchemy_cms",
          "vendor": "AlchemyCMS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0, \u003c 8.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0, \u003c 8.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller\u0027s ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:54:19.932Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6"
        }
      ],
      "source": {
        "advisory": "GHSA-mqq5-j7w8-2hgh",
        "discovery": "UNKNOWN"
      },
      "title": "Alchemy: Unauthenticated nested page API leaks restricted \u0026 unpublished content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57579",
    "datePublished": "2026-09-14T16:54:19.932Z",
    "dateReserved": "2026-06-24T18:49:56.208Z",
    "dateUpdated": "2026-09-14T17:40:12.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86777 (GCVE-0-2026-86777)

Vulnerability from nvd – Published: 2026-09-09 10:07 – Updated: 2026-09-09 14:04

Title

AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

Summary

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 14:04 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root Scorecard

References

8 references

URL	Tags
https://github.com/AlchemyCMS/alchemy_cms/securit…	vendor-advisory
https://github.com/AlchemyCMS/alchemy_cms/commit/…	patch
https://github.com/AlchemyCMS/alchemy_cms/commit/…	patch
https://github.com/AlchemyCMS/alchemy_cms/blob/v8…	technical-description
https://github.com/AlchemyCMS/alchemy_cms/release…	release-notes
https://github.com/AlchemyCMS/alchemy_cms/release…	release-notes
https://github.com/AlchemyCMS/alchemy_cms	product
https://www.vulncheck.com/advisories/alchemycms-b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
AlchemyCMS	alchemy_cms	Affected: 0 , < 7.4.16 (semver) Affected: 8.0.0 , < 8.3.6 (semver) cpe:2.3:a:alchemy-cms:alchemy_cms:::::::: cpe:2.3:a:alchemy-cms:alchemy_cms::::::::

Date Public

2026-07-27 00:00

Credits

Shohruh Yo'ldoshov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86777",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:04:08.114589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:04:34.359Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://rubygems.org/gems/alchemy_cms",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/alchemy_cms",
          "product": "alchemy_cms",
          "repo": "https://github.com/AlchemyCMS/alchemy_cms",
          "vendor": "AlchemyCMS",
          "versions": [
            {
              "lessThan": "7.4.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.6",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:alchemy-cms:alchemy_cms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:alchemy-cms:alchemy_cms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.3.6",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shohruh Yo\u0027ldoshov"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:27.218Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wppq-8h64-w78r)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r"
        },
        {
          "name": "Fix commit (8.3.6)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6"
        },
        {
          "name": "Fix commit (7.4.16)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554"
        },
        {
          "name": "Vulnerable Api::NodesController#index at v8.3.5",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/blob/v8.3.5/app/controllers/alchemy/api/nodes_controller.rb"
        },
        {
          "name": "alchemy_cms v8.3.6 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6"
        },
        {
          "name": "alchemy_cms v7.4.16 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms"
        },
        {
          "name": "VulnCheck Advisory: AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/alchemycms-before-7.4.16-and-8-x-before-8.3.6-missing-authorization-on-get-api-nodes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86777",
    "datePublished": "2026-09-09T10:07:27.218Z",
    "dateReserved": "2026-09-08T11:35:02.618Z",
    "dateUpdated": "2026-09-09T14:04:34.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23885 (GCVE-0-2026-23885)

Vulnerability from nvd – Published: 2026-01-19 21:09 – Updated: 2026-01-21 21:12

Title

AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

Summary

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-21 21:08 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/AlchemyCMS/alchemy_cms/securit…	x_refsource_CONFIRM
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
AlchemyCMS	alchemy_cms	Affected: < 7.4.12 Affected: >= 8.0.0.a, < 8.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-21T21:08:44.539151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-21T21:12:51.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alchemy_cms",
          "vendor": "AlchemyCMS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0.a, \u003c 8.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-21T14:55:46.175Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-2762-657x-v979",
        "discovery": "UNKNOWN"
      },
      "title": "AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23885",
    "datePublished": "2026-01-19T21:09:06.757Z",
    "dateReserved": "2026-01-16T21:02:02.901Z",
    "dateUpdated": "2026-01-21T21:12:51.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57579 (GCVE-0-2026-57579)

Vulnerability from cvelistv5 – Published: 2026-09-14 16:54 – Updated: 2026-09-14 17:40

Title

Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

Summary

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 17:39 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root Scorecard

References

11 references

URL	Tags
https://github.com/AlchemyCMS/alchemy_cms/securit…	x_refsource_CONFIRM
https://github.com/AlchemyCMS/alchemy_cms/pull/3982	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
AlchemyCMS	alchemy_cms	Affected: < 7.4.15 Affected: >= 8.0.0, < 8.0.15 Affected: >= 8.1.0, < 8.1.14 Affected: >= 8.2.0, < 8.2.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57579",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T17:39:44.487415Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T17:40:12.109Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alchemy_cms",
          "vendor": "AlchemyCMS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0, \u003c 8.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0, \u003c 8.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller\u0027s ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:54:19.932Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6"
        }
      ],
      "source": {
        "advisory": "GHSA-mqq5-j7w8-2hgh",
        "discovery": "UNKNOWN"
      },
      "title": "Alchemy: Unauthenticated nested page API leaks restricted \u0026 unpublished content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57579",
    "datePublished": "2026-09-14T16:54:19.932Z",
    "dateReserved": "2026-06-24T18:49:56.208Z",
    "dateUpdated": "2026-09-14T17:40:12.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86777 (GCVE-0-2026-86777)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:07 – Updated: 2026-09-09 14:04

Title

AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

Summary

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 14:04 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root Scorecard

References

8 references

URL	Tags
https://github.com/AlchemyCMS/alchemy_cms/securit…	vendor-advisory
https://github.com/AlchemyCMS/alchemy_cms/commit/…	patch
https://github.com/AlchemyCMS/alchemy_cms/commit/…	patch
https://github.com/AlchemyCMS/alchemy_cms/blob/v8…	technical-description
https://github.com/AlchemyCMS/alchemy_cms/release…	release-notes
https://github.com/AlchemyCMS/alchemy_cms/release…	release-notes
https://github.com/AlchemyCMS/alchemy_cms	product
https://www.vulncheck.com/advisories/alchemycms-b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
AlchemyCMS	alchemy_cms	Affected: 0 , < 7.4.16 (semver) Affected: 8.0.0 , < 8.3.6 (semver) cpe:2.3:a:alchemy-cms:alchemy_cms:::::::: cpe:2.3:a:alchemy-cms:alchemy_cms::::::::

Date Public

2026-07-27 00:00

Credits

Shohruh Yo'ldoshov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86777",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:04:08.114589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:04:34.359Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://rubygems.org/gems/alchemy_cms",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/alchemy_cms",
          "product": "alchemy_cms",
          "repo": "https://github.com/AlchemyCMS/alchemy_cms",
          "vendor": "AlchemyCMS",
          "versions": [
            {
              "lessThan": "7.4.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.6",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:alchemy-cms:alchemy_cms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:alchemy-cms:alchemy_cms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.3.6",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shohruh Yo\u0027ldoshov"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:27.218Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wppq-8h64-w78r)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r"
        },
        {
          "name": "Fix commit (8.3.6)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6"
        },
        {
          "name": "Fix commit (7.4.16)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554"
        },
        {
          "name": "Vulnerable Api::NodesController#index at v8.3.5",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/blob/v8.3.5/app/controllers/alchemy/api/nodes_controller.rb"
        },
        {
          "name": "alchemy_cms v8.3.6 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6"
        },
        {
          "name": "alchemy_cms v7.4.16 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms"
        },
        {
          "name": "VulnCheck Advisory: AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/alchemycms-before-7.4.16-and-8-x-before-8.3.6-missing-authorization-on-get-api-nodes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86777",
    "datePublished": "2026-09-09T10:07:27.218Z",
    "dateReserved": "2026-09-08T11:35:02.618Z",
    "dateUpdated": "2026-09-09T14:04:34.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23885 (GCVE-0-2026-23885)

Vulnerability from cvelistv5 – Published: 2026-01-19 21:09 – Updated: 2026-01-21 21:12

Title

AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

Summary

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-21 21:08 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/AlchemyCMS/alchemy_cms/securit…	x_refsource_CONFIRM
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
AlchemyCMS	alchemy_cms	Affected: < 7.4.12 Affected: >= 8.0.0.a, < 8.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-21T21:08:44.539151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-21T21:12:51.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alchemy_cms",
          "vendor": "AlchemyCMS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0.a, \u003c 8.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-21T14:55:46.175Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-2762-657x-v979",
        "discovery": "UNKNOWN"
      },
      "title": "AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23885",
    "datePublished": "2026-01-19T21:09:06.757Z",
    "dateReserved": "2026-01-16T21:02:02.901Z",
    "dateUpdated": "2026-01-21T21:12:51.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by AlchemyCMS

CVE-2026-57579 (GCVE-0-2026-57579)

CVE-2026-86777 (GCVE-0-2026-86777)

CVE-2026-23885 (GCVE-0-2026-23885)

CVE-2026-57579 (GCVE-0-2026-57579)

CVE-2026-86777 (GCVE-0-2026-86777)

CVE-2026-23885 (GCVE-0-2026-23885)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by AlchemyCMS

CVE-2026-57579 (GCVE-0-2026-57579)

CVE-2026-86777 (GCVE-0-2026-86777)

CVE-2026-23885 (GCVE-0-2026-23885)

CVE-2026-57579 (GCVE-0-2026-57579)

CVE-2026-86777 (GCVE-0-2026-86777)

CVE-2026-23885 (GCVE-0-2026-23885)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.