An issue exists in the GraalVM JavaScript sandbox allowlist enforcement due to the use of unescaped regular expressions when validating package names. Users with trigger creation privileges can exploit this by using the `Java.type()` function to access `java.util.zip.ZipFile` or `java.util.jar.JarFile` classes, enabling the reading of arbitrary files on the host system with the privileges of the ArcadeDB server process.