GHSA-48qw-824m-86pr

Summary

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

Severity

high

CVSS

7.7

CWE

CWE-269, CWE-863

Published

2026-07-16

Updated

2026-07-16

Advisory details

Impact

A user holding only reader (read-only) privileges on a single database could execute arbitrary JVM code by sending a "language": "js" command to the POST /api/v1/command/{database} HTTP endpoint, and use it to read arbitrary files on the host filesystem (e.g. /etc/passwd, configuration files), outside the scope of the database itself.

Two cooperating defects made this possible:

1. Missing authorization on the scripting path (CWE-863 / CWE-269). Polyglot script execution (js and other GraalVM languages) never went through the database authorization checks applied to SQL/Cypher, so any authenticated principal - regardless of database role - could run scripts.
2. Sandbox whitelist bypass. The GraalVM sandbox restricts direct class lookups to a configured allowedPackages list, but a script could reach arbitrary classes by reflecting off the bound database object: database.getClass().getClassLoader().loadClass("java.io.File").

Process creation was already blocked (allowCreateProcess(false)), so the confirmed impact is host file read, not OS command execution. Confidentiality: High. Integrity/Availability: None.

This is a distinct entry point and root cause from CVE-2026-44221, CVE-2026-54076 and CVE-2026-54077, and is reproducible on builds that already contain those fixes.

Patches

The fix is applied in the engine so it covers every entry point (HTTP command, HA-forwarded commands, MCP analyze), not only the HTTP handler:

• Polyglot script execution now requires the updateSecurity database-administrator permission on command, analyze and registerFunctions. The check runs on the request thread that carries the authenticated user and is a no-op in embedded mode and internal/system contexts (schema load, HA replication apply).
• The GraalVM host-access policy now denies access to java.lang.Class, java.lang.ClassLoader and java.lang.reflect members, closing the reflection escape that bypassed allowedPackages - even for authorized administrators - while leaving normal method calls on bound objects and explicit Java.type(...) lookups (governed by allowedPackages) working.

Workarounds

Until upgraded, do not grant command/query access on the HTTP API to untrusted users, and treat any account that can reach /api/v1/command as capable of code execution. Note that after the fix, non-administrator accounts can no longer run js/polyglot scripts over HTTP.

Credit

Reported by @kyojune76.

References

• https://github.com/advisories/GHSA-48qw-824m-86pr
• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-48qw-824m-86pr
• https://github.com/ArcadeData/arcadedb/releases/tag/26.7.1

Related advisories

• CVE-2026-106492 — high · npm/@backstage/backend-defaults
• CVE-2026-87998 — high · PyPI/open-webui
• CVE-2026-55485 — high · PyPI/piccolo-admin
• GHSA-j9fc-w3mr-x6mv — high · npm/@budibase/server
• CVE-2026-105678 — medium · npm/ghost
• CVE-2026-65835 — medium · Go/github.com/projectcapsule/capsule
• GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v5 — critical · Go/github.com/labstack/echo/v5
• GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v4 — critical · Go/github.com/labstack/echo/v4

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity