CVE-2026-23885
1 advisory.
RubyGems/alchemy_cms CVE-2026-23885: medium 6.4, EPSS 0.47%
AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper
Action: Upgrade alchemy_cms to 7.4.12 or later.
bundle update alchemy_cmsAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.4.12 | - |
| 8.0.0.a | 8.0.3 | - |
Fixed versions
| 7.4.12 | 8.0.3 |
Sources
- osv: GHSA-2762-657x-v979
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979
- https://nvd.nist.gov/vuln/detail/CVE-2026-23885
- https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26
- https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7
- https://github.com/AlchemyCMS/alchemy_cms
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/alchemy_cms/CVE-2026-23885.yml
CVE-2026-23885 · published · modified · JSON