{"id":"CVE-2026-67340","aliases":["EUVD-2026-51813","GHSA-w8vx-3rmm-v7rp","GHSA-x9f9-r4m8-9xc2"],"status":"published","title":"ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts","description":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00918,"percentile":0.60481,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78","CWE-94"],"published":"2026-07-16T20:15:36Z","modified":"2026-10-28T02:30:25Z","exploits":[{"source":"pocgithub","id":"0xdak/CVE-2026-67340_exploit","title":"0xdak/CVE-2026-67340_exploit","date":"2026-08-04","url":"https://github.com/0xdak/CVE-2026-67340_exploit"}],"fixes":[{"ecosystem":"Maven","package":"com.arcadedb:arcadedb-engine","fixed_in":["26.7.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.arcadedb:arcadedb-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.7.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.arcadedb:arcadedb-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.7.2"}]}],"versions":["21.10.1","21.10.2","21.11.1","21.12.1","21.9.1","21.9.1-beta","22.1.1","22.1.2","22.1.3","22.10.1","22.11.1","22.12.1","22.2.1","22.8.1","22.9.1","23.1.1","23.1.2","23.10.1","23.11.1","23.12.1","23.12.2","23.2.1","23.3.1","23.4.1","23.5.1","23.6.1","23.7.1","23.9.1","24.1.1","24.10.1","24.11.1","24.11.2","24.2.1","24.4.1","24.5.1","24.6.1","25.1.1","25.10.1","25.11.1","25.12.1","25.2.1","25.3.1","25.3.2","25.4.1","25.5.1","25.6.1","25.7.1","25.8.1","25.9.1","26.1.1","26.2.1","26.2.2","26.3.1","26.3.2","26.4.2","26.5.1","26.6.1","26.7.1"]}],"products":[{"vendor":"arcadedata","product":"arcadedb"}],"references":[{"url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/arcadedb-before-remote-code-execution-via-trigger-scripts","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67340","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w8vx-3rmm-v7rp"},{"url":"https://github.com/ArcadeData/arcadedb/releases/tag/26.7.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x9f9-r4m8-9xc2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67340.json","tags":["advisory"]},{"url":"https://github.com/ArcadeData/arcadedb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-67340","title":"ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts","description":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.","status":"published","published":"2026-08-01T12:22:18.178Z","modified":"2026-08-24T10:28:30.513Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-51813","description":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.","status":"published","published":"2026-08-01T12:22:18Z","modified":"2026-08-24T10:28:30Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:35.768217Z"}],"ghsa":[{"id":"GHSA-w8vx-3rmm-v7rp","title":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java...","description":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.","status":"published","published":"2026-08-01T15:30:29Z","modified":"2026-08-01T15:30:30Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:10:01.548476Z"},{"id":"GHSA-x9f9-r4m8-9xc2","title":"ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)","description":"ScriptTriggerExecutor sets allowedPackages to java.lang.*, java.util.*, java.time.*, java.math.* (ScriptTriggerExecutor.java:56); trigger creation is gated only at UPDATE_SCHEMA (LocalSchema.createTrigger:636). Permitting java.lang.* host-class lookup lets a trigger script do Java.type(\"java.lang.Runtime\").getRuntime().exec(...) (or ProcessBuilder). The reflection denylist does not block Java.type host lookups, and allowCreateProcess(false) only restricts GraalVM's guest process API, not a host Runtime.exec reached through HostAccess.ALL.\n\nExploit: a user with UPDATE_SCHEMA (schema admin, strictly less than security admin) runs CREATE TRIGGER ... EXECUTE JAVASCRIPT '\u003cruntime.exec\u003e' and obtains OS RCE when the trigger fires.\n\nFix: remove java.lang.* (and narrow the rest) from the trigger allow-list; if host interop is needed, expose an explicit @HostAccess.Export API surface instead of whole packages; consider gating trigger creation at UPDATE_SECURITY. Prefer an allow-list (HostAccess.EXPLICIT) over the current denylist-over-HostAccess.ALL.\n\nRelated medium/low items to fold into the fix: IMPORT DATABASE SSRF via unfollowed-redirect re-validation (SourceDiscovery.java:113), BACKUP/EXPORT DATABASE missing authorization (BackupDatabaseStatement.java:56, ExportDatabaseStatement.java:52), chunked-transfer body-size DoS bypass (HttpServer.java:301,318-333), and no brute-force lockout on password auth (ServerSecurity.java:189-205).","status":"published","published":"2026-07-16T20:15:36Z","modified":"2026-07-16T20:15:37Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:44.915484Z"}],"nvd":[{"id":"CVE-2026-67340","description":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.","status":"published","published":"2026-08-01T13:17:05.127Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-67340","title":"ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts","description":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.","status":"published","published":"2026-08-01T12:22:18.178Z","modified":"2026-10-28T02:30:25.293102124Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"GHSA-x9f9-r4m8-9xc2","title":"ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)","description":"ScriptTriggerExecutor sets allowedPackages to java.lang.*, java.util.*, java.time.*, java.math.* (ScriptTriggerExecutor.java:56); trigger creation is gated only at UPDATE_SCHEMA (LocalSchema.createTrigger:636). Permitting java.lang.* host-class lookup lets a trigger script do Java.type(\"java.lang.Runtime\").getRuntime().exec(...) (or ProcessBuilder). The reflection denylist does not block Java.type host lookups, and allowCreateProcess(false) only restricts GraalVM's guest process API, not a host Runtime.exec reached through HostAccess.ALL.\n\nExploit: a user with UPDATE_SCHEMA (schema admin, strictly less than security admin) runs CREATE TRIGGER ... EXECUTE JAVASCRIPT '\u003cruntime.exec\u003e' and obtains OS RCE when the trigger fires.\n\nFix: remove java.lang.* (and narrow the rest) from the trigger allow-list; if host interop is needed, expose an explicit @HostAccess.Export API surface instead of whole packages; consider gating trigger creation at UPDATE_SECURITY. Prefer an allow-list (HostAccess.EXPLICIT) over the current denylist-over-HostAccess.ALL.\n\nRelated medium/low items to fold into the fix: IMPORT DATABASE SSRF via unfollowed-redirect re-validation (SourceDiscovery.java:113), BACKUP/EXPORT DATABASE missing authorization (BackupDatabaseStatement.java:56, ExportDatabaseStatement.java:52), chunked-transfer body-size DoS bypass (HttpServer.java:301,318-333), and no brute-force lockout on password auth (ServerSecurity.java:189-205).","status":"published","published":"2026-07-16T20:15:36Z","modified":"2026-08-02T03:56:46.660247356Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}