Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2026-67340ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

High 7.2

In plain English

A high-severity code injection in arcadedb from ArcadeData. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.9%top 39.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.arcadedb:arcadedb-engine	26.7.2	GHSA-x9f9-r4m8-9xc2

Affected products (as reported)

Vendor	Product	Versions
ArcadeData	arcadedb	0 – before 26.7.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-x9f9-r4m8-9xc2) vendor-advisory
VulnCheck Advisory: ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts third-party-advisory