ArcadeDB Critical Vulnerability: Unauthorized JavaScript Execution
- Severity
- CRITICAL
- CVSS
- 9.9
- Affected component
- arcadedb (npm)
- Affected versions
- >= untagged-3026f5635164cd300b5b, <= untagged-3026f5635164cd300b5b or >= 26.7.2, <= 26.7.2 or >= 26.7.1, <= 26.7.1 or >= 26.6.1, <= 26.6.1 or >= 26.5.1, <= 26.5.1 or >= 26.4.2, <= 26.4.2 or >= 26.3.2, <= 26.3.2 or >= 26.3.1, <= 26.3.1 or >= 26.2.1, <= 26.2.1 or >= 26.1.1, <= 26.1.1 or >= 25.12.1, <= 25.12.1 or >= 25.11.1, <= 25.11.1 or >= 25.10.1, <= 25.10.1 or >= 25.9.1, <= 25.9.1 or >= 25.8.1, <= 25.8.1 or >= 25.7.1, <= 25.7.1 or >= 25.6.1, <= 25.6.1 or >= 25.4.1, <= 25.4.1 or >= 25.3.2, <= 25.3.2 or >= 25.3.1, <= 25.3.1 or >= 25.2.1, <= 25.2.1 or >= 25.1.1, <= 25.1.1 or >= 24.11.2, <= 24.11.2 or >= 24.11.1, <= 24.11.1 or >= 24.10.1, <= 24.10.1 or >= 24.6.1, <= 24.6.1 or >= 24.5.1, <= 24.5.1 or >= 24.4.1, <= 24.4.1 or >= 24.2.1, <= 24.2.1 or >= 24.1.1, <= 24.1.1 or >= 23.12.2, <= 23.12.2 or >= 23.12.1, <= 23.12.1 or >= 23.11.1, <= 23.11.1 or >= 23.10.1, <= 23.10.1 or >= 23.9.1, <= 23.9.1 or >= 23.7.1, <= 23.7.1 or >= 23.6.1, <= 23.6.1 or >= 23.5.1, <= 23.5.1 or >= 23.4.1, <= 23.4.1 or >= 23.3.1, <= 23.3.1 or >= 23.2.1, <= 23.2.1 or >= 23.1.2, <= 23.1.2 or >= 23.1.1, <= 23.1.1 or >= 22.12.1, <= 22.12.1 or >= 22.11.1, <= 22.11.1 or >= 22.10.1, <= 22.10.1 or >= 22.9.1, <= 22.9.1 or >= 22.8.1, <= 22.8.1 or >= 22.6.1, <= 22.6.1 or >= 22.2.1, <= 22.2.1 or >= 22.1.3, <= 22.1.3 or >= 22.1.2, <= 22.1.2 or >= 21.12.1, <= 21.12.1 or >= 21.11.1, <= 21.11.1 or >= 21.10.2, <= 21.10.2 or >= 21.10.1, <= 21.10.1 or >= 21.9.1, <= 21.9.1
- Patched version
- 26.8.1
ArcadeDB versions before 26.8.1 contain a critical vulnerability that allows authenticated readers to execute JavaScript commands without proper authorization checks. This can lead to the creation of server-wide administrator accounts.
What happened
ArcadeDB before version 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in the beginTransaction method. This oversight allows authenticated readers to execute JavaScript commands without the necessary scripting authorization checks. Attackers can exploit this by using the executeCommand function with a transaction ID to run unrestricted JavaScript, potentially creating server-wide administrator accounts.
The vulnerability affects multiple versions of ArcadeDB, specifically those before 26.8.1. The issue was first flagged on 2026-08-18 and confirmed shortly thereafter. The CVSS score for this vulnerability is 9.9, indicating a critical severity level.
What to do about it
- Upgrade to ArcadeDB version 26.8.1 or later to mitigate the risk of unauthorized JavaScript execution.
- Review your ArcadeDB configurations and ensure that all instances are running the patched version.
- Monitor your ArcadeDB logs for any unusual activity that may indicate an attempted exploit of this vulnerability.
- Consider implementing additional security measures such as network segmentation and access controls to limit the potential impact of this vulnerability.
How 0Day would have caught this
arcadedb is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using ArcadeDB versions before 26.8.1, you are affected by this vulnerability.
What should I do right now?
Immediately upgrade to ArcadeDB version 26.8.1 or later to protect your systems from this critical vulnerability.
Has this vulnerability been exploited in the wild?
According to the provided data, this vulnerability has not been exploited in the wild as of the confirmation date.