PT-2026-67320 · Arcadedb · Arcadedb

CVE-2026-67340 · Published 2026-07-16 · Updated 2026-08-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2

Description An issue exists in the arcadedb-engine where trigger scripts can look up host classes in java.lang.* via Java.type because the ScriptTriggerExecutor includes java.lang.* in the allowed packages. An authenticated user with UPDATE SCHEMA permissions can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() or ProcessBuilder, leading to operating system command execution when the trigger is activated. The reflection denylist fails to block these host lookups, and the allowCreateProcess(false) setting only restricts the GraalVM guest process API rather than the host Runtime.exec accessed through HostAccess.ALL.

Recommendations Update to version 26.7.2 or later. As a temporary mitigation, restrict the UPDATE SCHEMA permission to only highly trusted users to prevent the creation of malicious triggers.

Exploit

Fix

RCE

OS Command Injection

Code Injection

Weakness Enumeration

CWE-78

CWE-94

Related Identifiers

CVE-2026-67340

GHSA-X9F9-R4M8-9XC2

Affected Products

Arcadedb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67340.json · Exploit
• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-67340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-67340 · Security Note
• https://osv.dev/vulnerability/GHSA-x9f9-r4m8-9xc2 · Vendor Advisory
• https://github.com/ArcadeData/arcadedb/releases/tag/26.7.2 · Note
• https://github.com/ArcadeData/arcadedb · Note
• https://t.me/CVEtracker/62025 · Telegram Post
• https://vulncheck.com/advisories/arcadedb-before-remote-code-execution-via-trigger-scripts · Note