Executive brief
ArcadeDB is a database platform that allows users to create JavaScript triggers for automation. A flaw in the security sandbox that runs these triggers allows a user with schema-update permissions to bypass access restrictions and read sensitive application configuration files (such as database credentials and API keys) that are packaged with the application. This exposes secrets that should be protected from script access.
Technical details
The vulnerability is an incomplete deny-list (CWE-184) in HostClassLookupFilter that blocks java.util.ResourceBundle by exact class name match, but does not block its public subclasses java.util.PropertyResourceBundle and java.util.ListResourceBundle. These subclasses are permitted by the allow-list entry "java.util.*" and inherit the static getBundle() method from ResourceBundle. An authenticated user with UPDATE_SCHEMA privilege (required only to create/alter a JavaScript trigger, not server-admin rights) can instantiate these subclasses and invoke getBundle() to read .properties resources from the application classpath, bypassing the intended IOAccess.NONE sandbox restrictions on java.io, java.nio, and java.net. The attack requires only a single line of JavaScript in a trigger. No arbitrary filesystem read or RCE is possible; impact is limited to classpath resources.
Affected products
- ArcadeData ArcadeDB through 26.8.1
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 26.9.1