{"id":"CVE-2026-65831","summary":"ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read","details":"ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.","aliases":["GHSA-48qw-824m-86pr"],"modified":"2026-09-17T08:05:16.677577Z","published":"2026-09-15T15:18:32.339Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-269","CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65831.json"},"references":[{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/releases/tag/26.7.1"},{"type":"ADVISORY","url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-48qw-824m-86pr"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65831.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65831"},{"type":"FIX","url":"https://github.com/ArcadeData/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/arcadedata/arcadedb","events":[{"introduced":"0"},{"fixed":"8ca396c07e471a0b97fee075eeb956b5e24a23be"},{"fixed":"5347ff5fb225f2b1e3208faf7060facde020cb43"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"26.7.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["26.6.1","26.5.1","26.4.2","26.3.2","26.3.1","26.2.1","26.1.1","25.12.1","25.11.1","25.10.1","25.9.1","25.8.1","25.7.1","25.6.1","25.4.1","25.3.2","25.3.1","25.2.1","25.1.1","24.11.2","24.11.1","24.10.1","24.6.1","24.5.1","24.4.1","24.2.1","24.1.1","23.12.2","23.12.1","23.11.1","23.10.1","23.9.1","23.7.1","23.6.1","23.5.1","23.4.1","23.3.1","23.2.1","23.1.2","23.1.1","22.12.1","22.11.1","22.10.1","22.9.1","22.8.1","22.6.1","22.2.1","22.1.3","22.1.2","21.12.1","21.11.1","21.10.2","21.10.1","21.9.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65831.json","vanir_signatures_modified":"2026-09-17T08:05:16Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be","target":{"file":"engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java","function":"command"},"deprecated":false,"digest":{"function_hash":"287224511162009678737985552414778156138","length":1149},"id":"CVE-2026-65831-1158ea88"},{"digest":{"function_hash":"72905529752048162074634491194978992200","length":445},"id":"CVE-2026-65831-500e5c0b","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be","target":{"file":"engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java","function":"analyze"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be","target":{"file":"engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java"},"deprecated":false,"digest":{"line_hashes":["316917831851791058982899544577269559755","260351924230726989749792731911078392100","52453728028878660320094100885769107878","278675681103670567399734689158431811400","161670696491742229605157923110216379516","101632922629645757131171712071477178407","200050318251188126039324159806063471415","160547665296231084355477361584554761785","196837086705668296246248380569396672678","91606836727055658873322032377195324811","201331349122871426579972933322775674970","240596978105967921226229291234440617093","114173170609598901338895735491239976582","71701147341871068856405130094128201265","47924884211502292604646186297458983846","330826243411766358558764354826327069529","131584764946086742811687940224467204975","39320023067687651390555551982603240167","168913452561182168704289130395741108639"],"threshold":0.9},"id":"CVE-2026-65831-75625fb6","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be","target":{"file":"engine/src/main/java/com/arcadedb/query/polyglot/GraalPolyglotEngine.java"},"deprecated":false,"digest":{"line_hashes":["145143846714810496358003363227251796513","334321835278922219348113815941128753796","62297057567392065637928369543707952144","255005277998593742643152893969971247388","258609420489780274906575251932292676696","251331985248907308886037696470552437348","230184468619613166445794337532661003954"],"threshold":0.9},"id":"CVE-2026-65831-8aaf38f2","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be","target":{"file":"engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java","function":"registerFunctions"},"deprecated":false,"digest":{"function_hash":"18360468637623495921348558989702164339","length":269},"id":"CVE-2026-65831-e815fbd5"},{"deprecated":false,"digest":{"function_hash":"113313917482502338345284290626042146604","length":1031},"id":"CVE-2026-65831-ff1bd046","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be","target":{"file":"engine/src/main/java/com/arcadedb/query/polyglot/GraalPolyglotEngine.java","function":"GraalPolyglotEngine"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}