Preliminary research

Exploiting AQL Injection Vulnerabilities in ArangoDB

Daniel Kachakil · Anvil Secure · 25 March 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Explains AQL injection in collection and filter positions, including error-based, reflected, blind and timed extraction. Shows data modification and creation of JavaScript UDFs through system-collection writes, with filesystem access under permissive configurations. Includes the aqlmap tool.

Record

Researcher

Daniel Kachakil

Published by

Anvil Secure

Date

25 March 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Security advisory
• Tool

Tags

• nosqli
• injection
• database
• javascript
• info-leak
• privilege-escalation
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Daniel Kachakil, first published at the original source. Preserved copies are kept so the citation survives its host.