Get real-time updates on Telegram
CVE-2026-67341: arcadedb 0 to before 26.7.2
CVE-2026-67341. CVSS 3.1 base score 9.8 (CRITICAL, Vendor/CNA). EPSS 0.00543 (percentile 0.4482), scored 22-Oct-2026.
Affected technology
arcadedb · 0 to before 26.7.2
ArcadeData
Description’s affected range: versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js
Component: Not specified by the source
Function: statement, statements
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required
What an attacker can do
Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators. Vendor/CNA’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-863
- CCR priority
- 39.3 /100 (P4)
- CVSS 3.1
- 9.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · Vendor/CNA
- EPSS
- 0.00543 · percentile 0.4482 · 2026-10-22
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-24 01:40:49.068977+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-67341.html