Executive brief
Arc, a data processing tool, contains a vulnerability that allows any logged-in user to read sensitive files from the server's local storage. This could lead to the exposure of critical information such as database credentials, encryption keys, and environment variables. In some configurations, an attacker could also use this to access internal cloud metadata services, potentially leading to further compromise of the infrastructure.
Technical details
The vulnerability exists in Arc's SQL validator (internal/api/query.go:ValidateSQLRequest), which utilized an incomplete regex denylist for DuckDB functions. While it blocked 'read_parquet', it failed to account for other I/O functions like 'read_csv_auto', 'read_json', and 'read_blob'. Furthermore, the RBAC engine only inspected 'FROM' and 'JOIN' clauses, allowing scalar table functions in the 'SELECT' list to bypass table-level access controls. An authenticated attacker can exploit this to read local system files (e.g., /etc/passwd, auth.db) or perform SSRF via the 'httpfs' extension. The issue is fixed in version 2026.06.1 by implementing a structural sandbox that restricts DuckDB to specific allowed directories and disables external access.
Affected products
- Basekick Labs Arc < 0.0.0-20260520141557-91bdc29d1a02
Timeline
- 2026-05-19: disclosed: Reported by Alex Manson
- 2026-05-31: advisory: Initial advisory published
- 2026-06-08: patched: Patch confirmed and reviewed