Arc is an open, SQL-native time-series database for telemetry

Overview

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (internal/api/query.go:ValidateSQLRequest) blocked only read_parquet( and arc_partition_agg( via regex denylist. The broader DuckDB I/O function family — read_csv_auto, read_csv, read_json, read_json_auto, read_text, read_blob, glob, parquet_metadata, parquet_schema, read_xlsx, etc. — was not blocked. RBAC table-reference extraction inspected only FROM/JOIN clauses, so scalar table functions in the SELECT list slipped past both layers. This is fixed in 2026.06.1 via a structural sandbox at the DuckDB layer. After lockdown, DuckDB refuses to open any file outside the allowlist and refuses further INSTALL/LOAD. Already-loaded extensions remain callable. Some workarounds are available. Restrict API access to known-trusted networks via firewall rules or, as a temporary mitigation, add read_csv*/read_json*/glob etc. to dangerousSQLPattern in internal/api/query.go.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-47735)

Affected packages:

• github.com/basekick-labs/arc < 0.0.0-20260520141557-91bdc29d1a02

Patched in:

• github.com/basekick-labs/arc 0.0.0-20260520141557-91bdc29d1a02

Source: https://github.com/advisories/GHSA-p2j4-c4g6-rpf5