{"id":"GO-2026-5523","revision":"882f9c9771e448868082e5a70d8ac9af","records":[{"revision":"882f9c9771e448868082e5a70d8ac9af","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5523","aliases":["CVE-2026-47735","GHSA-p2j4-c4g6-rpf5"],"title":"Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc","description":"Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:19.2331353+00:00","affected":[{"ecosystem":"Go","name":"github.com/basekick-labs/arc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260520141557-91bdc29d1a02"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/Basekick-Labs/arc/security/advisories/GHSA-p2j4-c4g6-rpf5","https://github.com/Basekick-Labs/arc/commit/91bdc29d1a02178ccf8c66375eccf85203108dfb","https://github.com/Basekick-Labs/arc/pull/442"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5523","license":"OSV · upstream source license applies","key":"osv:GO-2026-5523","identifiers":["GO-2026-5523","CVE-2026-47735","GHSA-p2j4-c4g6-rpf5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}