Executive brief
ArcadeDB is a multi-model database engine. A security flaw allowed users with low-level access (even read-only permissions) to bypass security restrictions and execute arbitrary JavaScript code on the server. This could lead to unauthorized data access, server-side request forgery (SSRF), or a complete denial of service by exhausting system resources.
Technical details
A vulnerability in ArcadeDB's SQL engine allowed users to bypass the 'UPDATE_SECURITY' permission gate intended to restrict polyglot scripting. While the polyglot engine was previously hardened, the SQL path via 'DEFINE FUNCTION ... LANGUAGE js' lacked these permission checks in 'DefineFunctionStatement.executeSimple' and 'SQLQueryEngine'. An authenticated attacker, even with read-only database roles, could define and execute JavaScript functions. Although Java reflection was blocked, the environment still permitted 'IOAccess.ALL', enabling SSRF via 'load(url)' and resource exhaustion. The fix involves enforcing 'UPDATE_SECURITY' permissions across all code-execution surfaces and restricting the GraalVM context to 'IOAccess.NONE' and 'PolyglotAccess.NONE'.
Affected products
- ArcadeData arcadedb-engine < 26.7.2
Timeline
- 2026-07-09: patched: Fixed in version 26.7.2
- 2026-07-16: advisory: GitHub Advisory published