High severity7.5NVD Advisory· Published Aug 18, 2026· Updated Sep 8, 2026
CVE-2026-75840
CVE-2026-75840
Description
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <26.8.1
Patches
Vulnerability mechanics
References
2News mentions
1- ArcadeDB: Thirteen Critical and High Severity Auth/Authz Flaws Disclosed TogetherVypr Intelligence · Aug 18, 2026