CVE-2026-47735
2 advisories.
Go/github.com/basekick-labs/arc CVE-2026-47735: high
Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
Action: Upgrade github.com/basekick-labs/arc to 0.0.0-20260520141557-91bdc29d1a02 or later.
go get github.com/basekick-labs/arc@v0.0.0-20260520141557-91bdc29d1a02Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
| 0.0.0-20260520141557-91bdc29d1a02 |
Sources
- osv: GHSA-p2j4-c4g6-rpf5
- https://github.com/Basekick-Labs/arc/security/advisories/GHSA-p2j4-c4g6-rpf5
- https://github.com/Basekick-Labs/arc/pull/442
- https://github.com/Basekick-Labs/arc/commit/91bdc29d1a02178ccf8c66375eccf85203108dfb
- https://github.com/Basekick-Labs/arc
CVE-2026-47735 · published · modified · JSON
Go/github.com/basekick-labs/arc CVE-2026-47735: unknown
Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc
Action: Upgrade github.com/basekick-labs/arc to 0.0.0-20260520141557-91bdc29d1a02 or later.
go get github.com/basekick-labs/arc@v0.0.0-20260520141557-91bdc29d1a02Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
| 0.0.0-20260520141557-91bdc29d1a02 |
Sources
- osv: GO-2026-5523
- https://github.com/Basekick-Labs/arc/security/advisories/GHSA-p2j4-c4g6-rpf5
- https://github.com/Basekick-Labs/arc/commit/91bdc29d1a02178ccf8c66375eccf85203108dfb
- https://github.com/Basekick-Labs/arc/pull/442
CVE-2026-47735 · published · modified · JSON