CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.8.1 are vulnerable to an arbitrary file read vulnerability due to improper enforcement of allowlist validation in the GraalVM JavaScript sandbox. This flaw allows attackers with trigger creation privileges to exploit Java.type() and gain access to sensitive files on the host system, potentially leading to data exposure. Organizations using ArcadeDB should prioritize patching to mitigate the risk of unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.