OS command execution via trigger scripts in ArcadeDB (CVE-2026-67340)

ArcadeDB's ScriptTriggerExecutor permits trigger scripts to access the java.lang.* package, enabling host-class lookups via Java.type(). An authenticated user holding UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() or ProcessBuilder, achieving arbitrary OS command execution when the trigger fires. Affected versions: - < 26.7.2 We recommend updating to: 26.7.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2 Details: https://vuln.today/cve/CVE-2026-67340