CVE-2026-93598

Summary

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does not cover its subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with the UPDATE_SCHEMA privilege (sufficient to create or alter a JavaScript trigger; no server-admin rights required) can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke the inherited static ResourceBundle.getBundle(String) to read .properties resources from the application classpath, which the sandbox (IOAccess.NONE, with java.io., java.nio. and java.net.** denied) is intended to make unreachable. This can disclose packaged application configuration such as database credentials and API keys; the advisory states the issue does not provide arbitrary host filesystem read or remote code execution. Fixed in 26.9.1.

Affected Software

Weaknesses

• CWE-184: Incomplete List of Disallowed Inputs

References

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-j57p-qmrh-v7xv
• https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-classpath-credential-disclosure-via-resourcebundle

• ←Previous
• Next→