CVE-2026-47735: Arbitrary Local-File Read Vulnerability in github.com/basekick-labs/arc
Summary
CVE-2026-47735: Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc. Affects github.com/basekick-labs/arc versions < 0.0.0-20260520141557-91bdc29d1a02. Fixed in 0.0.0-20260520141557-91bdc29d1a02. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Arc is an open-source package designed for data manipulation and analysis, utilizing DuckDB for efficient I/O operations. It provides users with the ability to perform complex queries and manage data effectively. However, a critical vulnerability has been identified that allows authenticated users to bypass Role-Based Access Control (RBAC) checks, leading to unauthorized access to local files.
Vulnerability Detail
The vulnerability arises from the way Arc interacts with DuckDB I/O functions, which do not enforce RBAC table-level checks. This flaw enables authenticated users to read arbitrary local files on the server, potentially exposing sensitive information. The implications of this vulnerability are severe, as it could lead to data breaches and unauthorized access to confidential files.
How To Fix
Minimum fixed version
0.0.0-20260520141557-91bdc29d1a02
This is the first release that contains the fix.
go get github.com/basekick-labs/arc@v0.0.0-20260520141557-91bdc29d1a02Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the application or implement additional file access controls at the server level to mitigate the risk of unauthorized file reads until the package is updated.
Conclusion
The CVE-2026-47735 vulnerability in the Arc package poses a serious risk by allowing authenticated users to read arbitrary local files. It is crucial to update to the patched version to mitigate this risk. Additionally, employing temporary workarounds can help protect sensitive data until the update is applied.
See every vulnerability recorded for github.com/basekick-labs/arc →
FAQ
CVE-2026-47735 is a vulnerability in the Arc package that allows authenticated users to read arbitrary local files due to a bypass of RBAC checks.
If your application uses the Arc package, this vulnerability could allow unauthorized access to sensitive files, posing a significant security risk.
If an immediate update is not possible, consider implementing server-level file access restrictions as a temporary workaround.
More details can be found in the official vulnerability report at https://pkg.go.dev/vuln/GO-2026-5523.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the Gopkg.lock file. You can check if your application is affected by visiting Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/basekick-labs/arc.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.