ArcadeData ArcadeDB up to 26.9.0 Script Sandbox ResourceBundle.getBundle String sandbox

Summaryinfo

A vulnerability labeled as problematic has been found in ArcadeData ArcadeDB up to 26.9.0. The impacted element is the function ResourceBundle.getBundle of the component Script Sandbox. Such manipulation of the argument String leads to sandbox. This vulnerability is referenced as CVE-2026-93598. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in ArcadeData ArcadeDB up to 26.9.0 and classified as problematic. Affected by this issue is the function ResourceBundle.getBundle of the component Script Sandbox. The manipulation of the argument String with an unknown input leads to a sandbox vulnerability. Using CWE to declare the problem leads to CWE-265. Impacted is confidentiality. CVE summarizes:

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does not cover its subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with the UPDATE_SCHEMA privilege (sufficient to create or alter a JavaScript trigger; no server-admin rights required) can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke the inherited static ResourceBundle.getBundle(String) to read .properties resources from the application classpath, which the sandbox (IOAccess.NONE, with java.io.**, java.nio.** and java.net.** denied) is intended to make unreachable. This can disclose packaged application configuration such as database credentials and API keys; the advisory states the issue does not provide arbitrary host filesystem read or remote code execution. Fixed in 26.9.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-93598 since 09/18/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1611.

Upgrading to version 26.9.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• ArcadeData

Name

• ArcadeDB

Version

• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6
• 26.7
• 26.8
• 26.9.0

Website

• Product: https://github.com/ArcadeData/arcadedb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion