{"id":"CVE-2026-67340","title":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages","summary":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permi…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-94"],"published":"2026-08-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:34:34.997","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67340","references":[{"url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/arcadedb-before-remote-code-execution-via-trigger-scripts","label":"disclosure@vulncheck.com"}],"tags":["nvd","exploit-available"],"epss":0.006,"epssPercentile":0.47417,"exploits":{"github":1,"githubRepos":["https://github.com/0xdak/CVE-2026-67340_exploit"],"checkedAt":"2026-09-24T07:53:13.032Z"},"exploitAvailable":true,"ingestedAt":"2026-08-02T09:18:11.592Z","slug":"CVE-2026-67340","body":"## Overview\n\nArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":8200,"id":"CVE-2026-67340","ts":1788919980998,"field":"cvss","old":"9.8","new":"7.2"},{"seq":8199,"id":"CVE-2026-67340","ts":1788919980998,"field":"severity","old":"critical","new":"high"},{"seq":8009,"id":"CVE-2026-67340","ts":1788919279346,"field":"cvss","old":"7.2","new":"9.8"},{"seq":8008,"id":"CVE-2026-67340","ts":1788919279346,"field":"severity","old":"high","new":"critical"},{"seq":7818,"id":"CVE-2026-67340","ts":1788916339624,"field":"cvss","old":"9.8","new":"7.2"},{"seq":7817,"id":"CVE-2026-67340","ts":1788916339624,"field":"severity","old":"critical","new":"high"},{"seq":7627,"id":"CVE-2026-67340","ts":1788915296099,"field":"cvss","old":"7.2","new":"9.8"},{"seq":7626,"id":"CVE-2026-67340","ts":1788915296099,"field":"severity","old":"high","new":"critical"},{"seq":7436,"id":"CVE-2026-67340","ts":1788912702378,"field":"cvss","old":"9.8","new":"7.2"},{"seq":7435,"id":"CVE-2026-67340","ts":1788912702378,"field":"severity","old":"critical","new":"high"},{"seq":7245,"id":"CVE-2026-67340","ts":1788911330031,"field":"cvss","old":"7.2","new":"9.8"},{"seq":7244,"id":"CVE-2026-67340","ts":1788911330031,"field":"severity","old":"high","new":"critical"},{"seq":7049,"id":"CVE-2026-67340","ts":1788909067278,"field":"cvss","old":"9.8","new":"7.2"},{"seq":7048,"id":"CVE-2026-67340","ts":1788909067278,"field":"severity","old":"critical","new":"high"},{"seq":6861,"id":"CVE-2026-67340","ts":1788907390173,"field":"cvss","old":"7.2","new":"9.8"},{"seq":6860,"id":"CVE-2026-67340","ts":1788907390173,"field":"severity","old":"high","new":"critical"},{"seq":6663,"id":"CVE-2026-67340","ts":1788905433727,"field":"cvss","old":"9.8","new":"7.2"},{"seq":6662,"id":"CVE-2026-67340","ts":1788905433727,"field":"severity","old":"critical","new":"high"},{"seq":6481,"id":"CVE-2026-67340","ts":1788903458341,"field":"cvss","old":"7.2","new":"9.8"},{"seq":6480,"id":"CVE-2026-67340","ts":1788903458341,"field":"severity","old":"high","new":"critical"},{"seq":6416,"id":"CVE-2026-67340","ts":1788901907698,"field":"cvss","old":"9.8","new":"7.2"},{"seq":6415,"id":"CVE-2026-67340","ts":1788901907698,"field":"severity","old":"critical","new":"high"},{"seq":5432,"id":"CVE-2026-67340","ts":1788887281793,"field":"exploit_available","old":"false","new":"true"},{"seq":4315,"id":"CVE-2026-67340","ts":1788886395583,"field":"exploit_available","old":"true","new":"false"},{"seq":3053,"id":"CVE-2026-67340","ts":1788883059342,"field":"exploit_available","old":"false","new":"true"},{"seq":2082,"id":"CVE-2026-67340","ts":1788882464073,"field":"exploit_available","old":"true","new":"false"},{"seq":1148,"id":"CVE-2026-67340","ts":1788881901008,"field":"exploit_available","old":"false","new":"true"}]}