Critical Vulnerability in ArcadeDB: Unauthorized JavaScript Execution via SQL Injection
A critical vulnerability (GHSA-vwjc-v7x7-cm6g) has been discovered in ArcadeDB, a popular database management system. This vulnerability allows any user authorized for the database, including those with read-only roles, to bypass scripting authorization gates and execute arbitrary JavaScript code. The vulnerability has a CVSS score of 8.7 and can lead to severe impacts including SSRF, remote JavaScript inclusion, and unbounded CPU/memory DoS. Immediate patching to version 26.7.2 or later is highly recommended.