CVE-2026-67340: ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang. (via Java.type) because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
arcadedb-engineto a version that resolves this vulnerability.Fixed in 26.7.2 - Configuration
Update configuration so ScriptTriggerExecutor does not add java.lang.* to the allowed packages for trigger scripts, preventing access to java.lang.Runtime and ProcessBuilder.
ArcadeDB trigger scripts allowed Java packages (Java.type) = Disallow java.lang.*
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67340?
CVE-2026-67340 has a critical severity rating of 9.3.
What type of vulnerability is CVE-2026-67340?
CVE-2026-67340 is a remote code execution vulnerability due to improper handling of trigger scripts.
How do I fix CVE-2026-67340?
To fix CVE-2026-67340, upgrade ArcadeDB to version 26.7.2 or later.
Who is affected by CVE-2026-67340?
CVE-2026-67340 affects users of ArcadeDB versions prior to 26.7.2.
What is the risk associated with CVE-2026-67340?
CVE-2026-67340 presents a high risk of unauthorized remote code execution if exploited.