CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.8.1 are vulnerable due to a failure to properly bind the authenticated principal on the gRPC transaction executor thread, enabling authenticated users to bypass scripting authorization checks. This critical flaw allows attackers to execute arbitrary JavaScript commands, potentially creating unauthorized server-wide administrator accounts. Organizations using affected versions of ArcadeDB should prioritize immediate updates to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.