Executive brief
ArcadeDB is a graph database platform that uses JavaScript trigger scripts to respond to database events. Due to overly permissive Java package whitelisting in the script execution environment, an authenticated database user with schema modification rights can create a trigger that executes arbitrary operating system commands when the trigger fires, leading to full server compromise.
Technical details
The ScriptTriggerExecutor class improperly allows trigger JavaScript code to access the full java.lang.* package namespace via the Java.type() method. A user with UPDATE_SCHEMA permission can create a CREATE TRIGGER statement with embedded JavaScript that invokes java.lang.Runtime.getRuntime().exec() or java.lang.ProcessBuilder to execute OS commands. The vulnerability stems from adding java.lang.* to the allowedPackages list combined with HostAccess.ALL permissions, bypassing the reflection denylist since Java.type performs host-class lookup rather than reflection. The trigger fires automatically when database events occur, executing the attacker's payload. Fix available in version 26.7.2 which removes java.lang.* from the allowed package list.
Affected products
- ArcadeData ArcadeDB before 26.7.2
Timeline
- 2026-07-09: disclosed: GitHub Security Advisory GHSA-x9f9-r4m8-9xc2 published
- 2026-08-01: advisory: CVE-2026-67340 published on NVD
- 2026-07-09: patched: Fix available in version 26.7.2