« Volver al listado

CVE-2026-23885

Estado: AnalizadaCrítica (9.9)—

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated.

Leer descripción completaMostrar menos

Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-95 (code injection) con eval() en servicio remoto. AV:N/PR:L permite T1210 (servicios remotos con privilegios). Ejecuta comandos arbitrarios en el SO y puede elevar permisos (S:C). Riesgo crítico.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Alchemy-cms — Alchemy CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-23885",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23885",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-21T21:08:44.539151Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "AlchemyCMS",
          "product": "alchemy_cms",
          "versions": [
            {
              "status": "affected",
              "version": "< 7.4.12"
            },
            {
              "status": "affected",
              "version": ">= 8.0.0.a, < 8.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-19T22:16:02.453",
  "references": [
    {
      "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-95"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`."
    },
    {
      "lang": "es",
      "value": "Alchemy es un motor de sistema de gestión de contenido de código abierto escrito en Ruby on Rails. Antes de las versiones 7.4.12 y 8.0.3, la aplicación utiliza la función `eval()` de Ruby para ejecutar dinámicamente una cadena proporcionada por el atributo `resource_handler.engine_name` en `Alchemy::ResourcesHelper#resource_url_proxy`. La vulnerabilidad existe en `app/helpers/alchemy/resources_helper.rb` en la línea 28. El código omite explícitamente el análisis de seguridad con `# rubocop:disable Security/Eval`, indicando que el uso de una función peligrosa era conocido pero no mitigado adecuadamente. Dado que `engine_name` se obtiene de definiciones de módulos que pueden ser influenciadas por configuraciones de administración, permite a un atacante autenticado escapar de la sandbox de Ruby y ejecutar comandos de sistema arbitrarios en el sistema operativo anfitrión. Las versiones 7.4.12 y 8.0.3 solucionan el problema reemplazando `eval()` por `send()`."
    }
  ],
  "lastModified": "2026-06-17T10:22:15.387",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:alchemy-cms:alchemy_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F247A42-8A2A-4EB9-98D9-6D29401B36FF",
              "versionEndExcluding": "7.4.12"
            },
            {
              "criteria": "cpe:2.3:a:alchemy-cms:alchemy_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7950D68F-3FA8-4C37-8AC4-0F0D8D5B9110",
              "versionEndExcluding": "8.0.3",
              "versionStartIncluding": "8.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}