ArcadeDB privilege escalation via JS scripting in command API

Executive brief

ArcadeDB, a multi-model database engine, is vulnerable to a privilege escalation flaw. An authenticated user with only basic read-only access can bypass security restrictions to execute arbitrary code on the server. This allows an attacker to read sensitive files from the underlying operating system, such as system passwords or configuration files, potentially leading to a full compromise of the host environment.

Technical details

ArcadeDB is vulnerable to an authorization bypass and sandbox escape in its polyglot scripting engine (GraalVM). The vulnerability consists of two parts: first, the `/api/v1/command` endpoint fails to enforce database-level authorization for JavaScript commands, allowing any authenticated user (even those with only 'reader' roles) to execute scripts. Second, attackers can bypass the GraalVM sandbox whitelist by using reflection on the bound 'database' object to load arbitrary Java classes, such as 'java.io.File'. While process creation is blocked, this allows for arbitrary host file read. The issue is fixed in version 26.7.1 by requiring 'updateSecurity' permissions for script execution and hardening the host-access policy to deny reflection.

Affected products

• ArcadeData arcadedb-server < 26.7.1

Timeline

• 2026-07-01: patched: Fix applied in engine and version 26.7.1 released.
• 2026-07-16: advisory: GitHub Advisory GHSA-48qw-824m-86pr published.

References

• https://api.github.com/users/kyojune76
• https://github.com/kyojune76
• https://api.github.com/users/kyojune76/gists%7B/gist_id%7D
• https://api.github.com/users/kyojune76/repos
• https://avatars.githubusercontent.com/u/154435744?v=4
• https://api.github.com/users/kyojune76/events%7B/privacy%7D