CVE-2026-67340
Received Received - Intake

ArcadeDB Engine OS Command Execution via JavaScript Trigger

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67340
EUVD
EUVD-2026-51813

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ArcadeDB before version 26.7.2 has a vulnerability where trigger scripts can access restricted Java classes like java.lang.* through ScriptTriggerExecutor. This allows authenticated users with UPDATE_SCHEMA permission to create JavaScript triggers that execute OS commands via functions like Runtime.getRuntime().exec() when the trigger activates.

Detection Guidance

Check ArcadeDB version with 'arcadedb version' or inspect the engine version in logs. Look for unauthorized JavaScript triggers with UPDATE_SCHEMA permissions. Monitor for unexpected system processes spawned by ArcadeDB.

Impact Analysis

An attacker with UPDATE_SCHEMA permission could exploit this to run arbitrary OS commands on the server hosting ArcadeDB. This could lead to full system compromise, data theft, or disruption of services. The impact is severe due to the high CVSS scores indicating remote code execution without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access or exfiltration of sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade ArcadeDB to version 26.7.2 or later immediately. Remove UPDATE_SCHEMA permissions from non-admin users. Disable JavaScript triggers if not required. Review and audit all existing triggers for malicious patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67340. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart