CVE-2026-65831

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-65831

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65831.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-65831

Aliases

GHSA-48qw-824m-86pr

Published

2026-09-15T15:18:32Z

Modified

2026-09-17T08:05:16Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

Details

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65831.json"
}

References

Affected packages

Git / github.com/arcadedata/arcadedb

Affected ranges

Type

GIT

Repo

https://github.com/arcadedata/arcadedb

Events

Introduced

Fixed

8ca396c07e471a0b97fee075eeb956b5e24a23be

Fixed

5347ff5fb225f2b1e3208faf7060facde020cb43

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.7.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

21.*

21.10.1

21.10.2

21.11.1

21.12.1

21.9.1

22.*

22.1.2

22.1.3

22.10.1

22.11.1

22.12.1

22.2.1

22.6.1

22.8.1

22.9.1

23.*

23.1.1

23.1.2

23.10.1

23.11.1

23.12.1

23.12.2

23.2.1

23.3.1

23.4.1

23.5.1

23.6.1

23.7.1

23.9.1

24.*

24.1.1

24.10.1

24.11.1

24.11.2

24.2.1

24.4.1

24.5.1

24.6.1

25.*

25.1.1

25.10.1

25.11.1

25.12.1

25.2.1

25.3.1

25.3.2

25.4.1

25.6.1

25.7.1

25.8.1

25.9.1

26.*

26.1.1

26.2.1

26.3.1

26.3.2

26.4.2

26.5.1

26.6.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65831.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "287224511162009678737985552414778156138",
            "length": 1149
        },
        "id": "CVE-2026-65831-1158ea88",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java",
            "function": "command"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "72905529752048162074634491194978992200",
            "length": 445
        },
        "id": "CVE-2026-65831-500e5c0b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java",
            "function": "analyze"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "316917831851791058982899544577269559755",
                "260351924230726989749792731911078392100",
                "52453728028878660320094100885769107878",
                "278675681103670567399734689158431811400",
                "161670696491742229605157923110216379516",
                "101632922629645757131171712071477178407",
                "200050318251188126039324159806063471415",
                "160547665296231084355477361584554761785",
                "196837086705668296246248380569396672678",
                "91606836727055658873322032377195324811",
                "201331349122871426579972933322775674970",
                "240596978105967921226229291234440617093",
                "114173170609598901338895735491239976582",
                "71701147341871068856405130094128201265",
                "47924884211502292604646186297458983846",
                "330826243411766358558764354826327069529",
                "131584764946086742811687940224467204975",
                "39320023067687651390555551982603240167",
                "168913452561182168704289130395741108639"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65831-75625fb6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "145143846714810496358003363227251796513",
                "334321835278922219348113815941128753796",
                "62297057567392065637928369543707952144",
                "255005277998593742643152893969971247388",
                "258609420489780274906575251932292676696",
                "251331985248907308886037696470552437348",
                "230184468619613166445794337532661003954"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65831-8aaf38f2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/query/polyglot/GraalPolyglotEngine.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "18360468637623495921348558989702164339",
            "length": 269
        },
        "id": "CVE-2026-65831-e815fbd5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java",
            "function": "registerFunctions"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "113313917482502338345284290626042146604",
            "length": 1031
        },
        "id": "CVE-2026-65831-ff1bd046",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/query/polyglot/GraalPolyglotEngine.java",
            "function": "GraalPolyglotEngine"
        }
    }
]

vanir_signatures_modified

"2026-09-17T08:05:16Z"