CVE-2026-67340

CriticalCVSS 9.8

Published: 01/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Summary

ArcadeDB before version 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.

Risk Assessment

The risk is that an authenticated user can execute arbitrary OS commands, potentially leading to full server compromise.

Recommendation

Upgrade ArcadeDB to version 26.7.2 or later, which fixes this vulnerability.

Original NVD description (English source)

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.