Tag
#ArcadeDB
Privilege Escalation Vulnerability in ArcadeDB via JavaScript Triggers (CVE-2026-67356)
A critical vulnerability (CVE-2026-67356) has been discovered in ArcadeDB, a popular database management system. The vulnerability has a CVSS score of 8.8 and allows attackers with UPDATE_SCHEMA permission to create triggers that execute JavaScript, leading to privilege escalation and potential creation of server-wide admin users. This vulnerability affects ArcadeDB versions before 26.7.3 and has not been actively exploited in the wild. Immediate patching or mitigation is recommended to prevent potential attacks.
Understanding and Defending Against Cross-Database IDOR in ArcadeDB
This educational analysis covers a critical vulnerability in ArcadeDB, a cross-database Insecure Direct Object Reference (IDOR) issue that allows unauthorized access to databases. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, detection strategies, and defensive measures.
Critical Vulnerability in ArcadeDB: Unauthorized JavaScript Execution via SQL Injection
A critical vulnerability (GHSA-vwjc-v7x7-cm6g) has been discovered in ArcadeDB, a popular database management system. This vulnerability allows any user authorized for the database, including those with read-only roles, to bypass scripting authorization gates and execute arbitrary JavaScript code. The vulnerability has a CVSS score of 8.7 and can lead to severe impacts including SSRF, remote JavaScript inclusion, and unbounded CPU/memory DoS. Immediate patching to version 26.7.2 or later is highly recommended.