Executive brief
ArcadeDB is a multi-model database engine. A vulnerability in its trigger system allows users with schema-level administrative privileges to execute arbitrary operating system commands on the server. This could lead to a full system compromise, unauthorized data access, or service disruption. This issue is resolved in version 26.7.2.
Technical details
The ScriptTriggerExecutor in ArcadeDB incorrectly includes 'java.lang.*' in its allowedPackages list for GraalVM-based JavaScript triggers. Because trigger creation only requires UPDATE_SCHEMA privileges rather than full security admin rights, an attacker can create a trigger that uses Java.type("java.lang.Runtime").getRuntime().exec() to execute arbitrary OS commands. The existing reflection denylist and GraalVM's allowCreateProcess(false) setting fail to block this path because they do not restrict host-class lookups via HostAccess.ALL. The fix in version 26.7.2 removes java.lang from the allow-list and implements stricter HostAccess controls. The update also addresses secondary issues including SSRF in database imports and missing authorization checks in backup/export functions.
Affected products
- ArcadeData arcadedb-engine < 26.7.2
Timeline
- 2026-07-09: disclosed: Initial disclosure and release of version 26.7.2
- 2026-07-16: advisory: GitHub Advisory published