EUVD-2026-51813
GHSA-w8vx-3rmm-v7rp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API, low complexity, high privilege required (UPDATE_SCHEMA); scope change to host OS via Runtime.exec() warrants S:C with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
8Blast Radius
ecosystem impact- 18 maven packages depend on com.arcadedb:arcadedb-engine (9 direct, 9 indirect)
Ecosystem-wide dependent count for version 26.7.2.
DescriptionCVE.org
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.
AnalysisAI
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaScript trigger scripts, because ScriptTriggerExecutor grants sandbox access to the full java.lang.* package, allowing direct invocation of java.lang.Runtime.getRuntime().exec() or ProcessBuilder. Any account holding UPDATE_SCHEMA permission can create a trigger that fires OS commands server-side against the underlying host process. No public exploit has been identified at time of analysis, but SSVC rates the technical impact as total and the attack as automatable, and the GHSA advisory provides sufficient implementation detail to lower the barrier for capable threat actors.
Technical ContextAI
ArcadeDB is a multi-model NoSQL database engine built on Java with GraalVM polyglot scripting support for triggers. The root cause (CWE-94, Improper Control of Code Generation) lies in ScriptTriggerExecutor.java line 56, where the GraalVM JavaScript context is initialized with an allowed-package list that includes java.lang.*, java.util.*, java.time.*, and java.math.* under HostAccess.ALL. This configuration permits trigger scripts to call Java.type('java.lang.Runtime') and chain .getRuntime().exec(), which are standard Java OS-execution primitives. Two sandbox controls that should have prevented this fail: the GraalVM reflection denylist does not intercept Java.type host-class lookups, and allowCreateProcess(false) only blocks the GraalVM guest-process API - it has no effect on Runtime.exec() accessed through the unrestricted HostAccess.ALL host-object bridge. Trigger creation is gated at LocalSchema.createTrigger (line 636) by the UPDATE_SCHEMA permission, one tier below full UPDATE_SECURITY. The affected Maven package is com.arcadedb:arcadedb-engine, all versions below 26.7.2 per CPE cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade to ArcadeDB 26.7.2, which is confirmed as the fixed version by both the vendor GHSA advisory and EUVD data. The fix removes java.lang.* from the ScriptTriggerExecutor allowed-package list and narrows the GraalVM host-access configuration; the vendor recommends migrating from HostAccess.ALL to HostAccess.EXPLICIT with explicitly annotated @HostAccess.Export methods if host interop is operationally required. If immediate patching is not feasible, restrict UPDATE_SCHEMA permission to the absolute minimum set of accounts - preferably gating trigger creation at UPDATE_SECURITY (the next higher privilege tier) as a hardening measure. Existing triggers should be audited for calls to Java.type(), Runtime.exec(), or ProcessBuilder to identify any prior exploitation. Disabling JavaScript trigger creation entirely eliminates the attack surface at the cost of losing that scripting capability. The full vendor advisory including fix guidance is at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today