Threats tagged 'ghsa-93cm-2v4m-c56c'

A vulnerability in Arc's integration with DuckDB allows any authenticated user, even with no permissions, to bypass database role-based access control (RBAC) and read data across all tenant databases within the shared storage root. The issue arises because the sandbox configuration permits access to the entire multi-tenant storage root, and the RBAC checks do not inspect table-valued functions such as DuckDB's I/O aliases (e.g., parquet_scan). Additionally, the SQL denylist only blocks the literal function read_parquet, missing other aliases and related functions. This enables cross-database data exposure despite RBAC enforcement.