Description
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ArcadeData | arcadedb | < 26.10.1 | 26.10.1 |
References
- GitHub Security Advisory (GHSA-h2j4-28h8-cj5v) vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization third-party-advisory