From 249972fc13a6af0e66f63e150ef5c0ce709e8ef8 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Wed, 2 Sep 2026 11:06:26 -0400
Subject: [PATCH] Two new alchemy_cms advisories

---
 gems/alchemy_cms/GHSA-4qhx-6wrv-5hg2.yml | 26 ++++++++++++++++++++++++
 gems/alchemy_cms/GHSA-g7vv-4mjj-6fgm.yml | 26 ++++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 gems/alchemy_cms/GHSA-4qhx-6wrv-5hg2.yml
 create mode 100644 gems/alchemy_cms/GHSA-g7vv-4mjj-6fgm.yml

diff --git a/gems/alchemy_cms/GHSA-4qhx-6wrv-5hg2.yml b/gems/alchemy_cms/GHSA-4qhx-6wrv-5hg2.yml
new file mode 100644
index 0000000000..932a71d79d
--- /dev/null
+++ b/gems/alchemy_cms/GHSA-4qhx-6wrv-5hg2.yml
@@ -0,0 +1,26 @@
+---
+gem: alchemy_cms
+ghsa: 4qhx-6wrv-5hg2
+url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-4qhx-6wrv-5hg2
+title: Account Takeover & Privilege-Escalation To Admin via Stored
+  XSS in Menu Node Name Rendered in Admin Configure Dialog Page Content
+date: 2026-09-02
+description: |
+  An improper input sanitization vulnerability in the menu node name
+  rendering allows Author-level users to inject stored JavaScript
+  that executes in an Admin's browser when they open the configure
+  dialog for a page referencing the malicious node. The payload
+  executes with the Admin's session privileges, allowing an attacker
+  to perform administrative actions and create an attacker-controlled
+  administrator account, resulting in full account takeover and
+  privilege escalation.
+cvss_v3: 9.0
+patched_versions:
+  - ">= 8.3.8"
+related:
+  url:
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.8
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-4qhx-6wrv-5hg2
+notes: |
+  - No CVE in GHSA url.
+  - cvss_v3 from GHSA url.
diff --git a/gems/alchemy_cms/GHSA-g7vv-4mjj-6fgm.yml b/gems/alchemy_cms/GHSA-g7vv-4mjj-6fgm.yml
new file mode 100644
index 0000000000..dfcc751c2b
--- /dev/null
+++ b/gems/alchemy_cms/GHSA-g7vv-4mjj-6fgm.yml
@@ -0,0 +1,26 @@
+---
+gem: alchemy_cms
+ghsa: g7vv-4mjj-6fgm
+url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-g7vv-4mjj-6fgm
+title: Account Takeover & Privilege-Escalation To Admin via Stored
+  XSS in Menu Node Name Rendered in Page Properties Configure Dialog
+date: 2026-09-02
+description: |
+  An improper input sanitization vulnerability in the Page Properties
+  menu node rendering allows Author-level users to inject stored
+  JavaScript that executes in an Admin's browser when they open the
+  Configure dialog for a page containing the malicious node. The
+  payload executes with the Admin's session privileges, allowing
+  an attacker to perform administrative actions and create an
+  attacker-controlled administrator account, resulting in full
+  account takeover and privilege escalation.
+cvss_v3: 9.0
+patched_versions:
+  - ">= 8.3.8"
+related:
+  url:
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.8
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-g7vv-4mjj-6fgm
+notes: |
+  - No CVE in GHSA url.
+  - cvss_v3 from GHSA url.