Skip to content
OpenAdvisories

Package · Go

github.com/basekick-labs/arc

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-47735

    Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

    Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc_partition_agg(` via regex denylist. The broader DuckDB I/O fun…

    Basekick-Labs arc github.com/basekick-labs/arc Go
  • High 8.8
    CVE-2026-48050

    Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

    Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cm…

    Basekick-Labs arc github.com/basekick-labs/arc Go