CVE-2026-67340
CRITICAL · 9.8Fresh disclosure, no PoC public yet, KEV absent; monitoring phase precedes active exploitation signal.
What: ArcadeDB before 26.7.2 allows authenticated users with UPDATE_SCHEMA permission to execute arbitrary OS commands via malicious JavaScript trigger scripts that invoke java.lang.Runtime (CVSS 9.8 CRITICAL).
Why it matters: Released today; CRITICAL severity and high CVSS signal genuine risk. However, KEV is not yet listed, and no public PoC or in-the-wild exploitation confirmed. Social chatter is primarily feed-republishing of the NVD entry and threat intel vendors aggregating the disclosure—typical first-day noise for newly published vulns.
Where it's seen: Bluesky posts from security feeds and threat intel aggregators repeating the CVE description; links to vulnerability databases and radar services. No defender triage questions, no exploit code drops, no vendor emergency patches observed yet.
RISK: CRITICAL — Requires UPDATE_SCHEMA role; OS command execution on trigger fire; immediate patching recommended.
Description
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High