CVE-2026-67340 ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts
Authenticated users with schema update permissions can execute arbitrary OS commands via malicious JavaScript triggers in ArcadeDB.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67340?
CVE-2026-67340 is a high-severity code injection vulnerability in ArcadeData arcadedb, published on 1 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.
Weakness: CWE-94
Which versions are affected by CVE-2026-67340?
2 open source packages ship an affected version, including com.arcadedb:arcadedb-engine.
| Package | Affected | Fixed in |
|---|---|---|
com.arcadedb:arcadedb-engine Maven | All versions | 26.7.2 |
com.arcadedb:arcadedb-engine Maven | All versions | 26.7.2 |
How do I fix CVE-2026-67340?
Upgrade com.arcadedb:arcadedb-engine to 26.7.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-67340 being exploited?
There is no known exploitation of CVE-2026-67340 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-w8vx-3rmm-v7rp, GHSA-x9f9-r4m8-9xc2.