The admin layout wrote the value of the alchemy-elements-window-width cookie into the style attribute of the admin <body> without checking it:

<%= content_tag :body, id: 'alchemy', class: alchemy_body_class, style: cookies["alchemy-elements-window-width"] && "–elements-window-width: #{cookies["alchemy-elements-window-width"]}px" do %>

The admin JavaScript sets this cookie to the width the user dragged the elements window to. A cookie value like 1; background: url(//attacker.example) ends the custom property and adds further CSS declarations to the body's inline style.

Impact

Rails escapes the attribute value, so the cookie cannot add HTML or script, only CSS declarations on the <body> element. With those an attacker can change how the admin interface looks, for example hide or cover parts of it, or load a background image from a server they control and learn when the page was opened. Inline styles have no selectors, so CSS techniques that read form values or other page content do not apply.