CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.7.2 are vulnerable due to inadequate enforcement of scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js, allowing attackers with database access to execute arbitrary JavaScript code. This critical vulnerability can lead to unauthorized access and manipulation of the database, compromising data integrity and security. Organizations using affected versions of ArcadeDB should prioritize immediate updates to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.