A critical code-injection flaw in ArcadeDB before 26.7.2 lets JavaScript trigger scripts reach java.lang.* host classes and execute arbitrary OS commands on the database host.
What Is It
CVE-2026-67340 is a code injection vulnerability (CWE-94) in the ArcadeDB engine (arcadedb-engine). The ScriptTriggerExecutor component adds java.lang.* to its list of allowed packages, which means trigger scripts can look up host classes through Java.type. An authenticated user holding UPDATE_SCHEMA permission can create a JavaScript trigger that calls java.lang.Runtime.getRuntime().exec() or ProcessBuilder. When that trigger fires, the commands run at the OS level.
The issue was disclosed via VulnCheck and is tracked in an ArcadeData GitHub security advisory (GHSA-x9f9-r4m8-9xc2).
Why It Matters
The published CVE record (CVE-2026-67340, viewable at cve.org and mirrored at NVD, both linked below) carries a CVSS 3.1 base score of 9.8 (Critical): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a secondary CVSS 4.0 score of 9.3 (Critical). Both scores are CNA-supplied values recorded in that CVE record rather than independent assessments; the CVE has not completed NVD analysis, so NVD has not published its own scoring.
Read the vector carefully against the technical description. The 3.1 vector asserts PR:N, no privileges required, but the exploitation path described in the advisory requires an authenticated account with UPDATE_SCHEMA permission on the target database. Those two statements are not consistent. A vector reflecting the described precondition would score lower than 9.8. Treat the 9.8 as an upper bound pending NVD analysis, and scope your own urgency to who actually holds schema-modification rights on your instances.
The practical result, once that precondition is met, is command execution on the machine running the database. The sandbox that trigger scripts are supposed to operate inside does not hold, so schema-level access converts into host-level access.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time.
What's Vulnerable
- Vendor/product: ArcadeData; ArcadeDB
- Package:
pkg:maven/com.arcadedb/arcadedb-engine - Affected versions: all versions before 26.7.2 (semver
< 26.7.2) - Not affected: 26.7.2 and later
The CVE record carries no enumerated CPE entries yet; version data comes from the vendor-supplied affected-product block in that record, so it should be checked against the GitHub advisory before you rely on it for inventory matching.
Patch Status
ArcadeDB 26.7.2 is listed as unaffected; upgrading arcadedb-engine to 26.7.2 or later is the fix. Per the CVE record, it was published 2026-08-01 and its status is still "Received," meaning it has not completed NVD analysis; both the publication date and the status are fields you can confirm directly on the record pages linked below. No CISA-required action date applies, as this CVE was not supplied with a KEV entry.
Where an immediate upgrade is not possible, audit which accounts hold UPDATE_SCHEMA and revoke it from any that do not need it; that permission is the gate on this attack path.
Sources
- ArcadeData GitHub Security Advisory (GHSA-x9f9-r4m8-9xc2), https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2
- VulnCheck Advisory; https://www.vulncheck.com/advisories/arcadedb-before-remote-code-execution-via-trigger-scripts
- CVE Record (CVE.org), scores, vector, affected-version block, publication date and record status; https://www.cve.org/CVERecord?id=CVE-2026-67340
- NVD entry (analysis pending), https://nvd.nist.gov/vuln/detail/CVE-2026-67340