Executive brief
ArcadeDB is a multi-model database that uses GraalVM's JavaScript engine to execute user-defined triggers and functions. A flaw in the sandbox security allowlist allows users with trigger creation privileges to read arbitrary files from the server's filesystem by exploiting how package names are validated using unescaped regular expressions, potentially exposing sensitive configuration files, keys, or application data.
Technical details
The vulnerability is a sandbox bypass in GraalVM JavaScript execution due to improper regex escaping in the package allowlist. The allowlist entries (e.g., "java.util.*", "java.time.*", "java.math.*") are matched using String.matches() which interprets them as regular expressions rather than literal prefixes. The unescaped dot metacharacters cause "java.util.*" to match unintended packages like java.util.zip and java.util.jar. An attacker with trigger creation privileges can invoke Java.type("java.util.zip.ZipFile") to instantiate ZipFile with a filesystem path, then call getInputStream() to read arbitrary files as the ArcadeDB server process. This bypasses the IOAccess restrictions because the vulnerable classes are explicitly allowlisted. The fix, released in version 26.8.1, properly escapes the regex patterns in the allowlist configuration.
Affected products
- ArcadeData ArcadeDB before 26.8.1
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: version 26.8.1