CVE-2026-67340: ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts
Published Aug 1, 2026
·Updated
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang. (via Java.type) because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.
Affected Software
1 affected component
ArcadeDB arcadedb-engine<26.7.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
arcadedb-engineto a version that resolves this vulnerability.Fixed in 26.7.2 - Configuration
Update configuration so ScriptTriggerExecutor does not add java.lang.* to the allowed packages for trigger scripts, preventing access to java.lang.Runtime and ProcessBuilder.
ArcadeDB trigger scripts allowed Java packages (Java.type) = Disallow java.lang.*
Event History
Aug 1, 2026
CVE Published
via MITRE·12:22 PM
Data Sourced
via MITRE·12:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness