PT-2026-64826

The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabaseUPDATE SECURITY gate on the polyglot engine PolyglotQueryEngine.java:112-114,126,176,199, but only there. The SQL route to JavaScript never touches it: DefineFunctionStatement.executeSimple DefineFunctionStatement.java:37-100,...