com.arcadedb:arcadedb-engine@22.12.1

Affected versions of this package are vulnerable to Command Injection through the ScriptTriggerExecutor in engine/src/main/java/com/arcadedb/schema/trigger/ScriptTriggerExecutor.java. An attacker can execute OS commands by creating a JavaScript trigger that uses Java.type("java.lang.Runtime").getRuntime().exec(...) or ProcessBuilder and then firing the trigger. The vulnerable trigger sandbox allowed java.lang.* host-class lookups for schema users with UPDATE_SCHEMA, so a malicious trigger script could access host methods and run system commands on the server. This breaks trigger execution isolation and lets a schema administrator obtain arbitrary command execution on the host.

Notes

• DEFINE FUNCTION ... LANGUAGE js is gated by UPDATE_SECURITY, not the usual schema-level mutation permission, so the RCE path is narrower than generic schema edits.
• The trigger exploit depends on GraalVM host-class lookup being enabled for java.lang.*; native JavaScript-only triggers remain unaffected.

Upgrade com.arcadedb:arcadedb-engine to version 26.7.2 or higher.

Affected versions of this package are vulnerable to Incorrect Authorization in the LocalDocumentType and LocalProperty schema-mutator methods. An attacker can mutate their database schema by sending DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY requests with an authenticated identity that lacks UPDATE_SCHEMA, including a read-only API token. This lets the attacker rename types, change inheritance, and alter property constraints on the affected database, breaking the meaning of stored records and bypassing the documented schema-permission model.

Notes

• LocalDocumentType and LocalProperty are only reachable through the SQL DDL path; in server deployments that expose the HTTP command/query endpoints, a read-only API token can reach the vulnerable mutators even though it lacks schema-write permission.
• The affected schema changes include type renames, supertype/alias/bucket changes, and property constraint/value metadata updates, so the impact is broader than just creating or dropping a property.

Workarounds

• Grant write access only to trusted users and API tokens; keep schema DDL (DROP PROPERTY, ALTER TYPE, ALTER PROPERTY) available only to administrators until you can upgrade. This prevents a read-only or otherwise untrusted identity from mutating the schema over the database command/query HTTP endpoints.

Upgrade com.arcadedb:arcadedb-engine to version 26.6.1 or higher.

Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the DefineFunctionStatement.executeSimple path in engine/src/main/java/com/arcadedb/query/sql/parser/DefineFunctionStatement.java. An attacker can execute arbitrary JavaScript by sending DEFINE FUNCTION ... LANGUAGE js through the SQL command API and then invoking the function with SELECT, even when they are authorized for the database but lack security-admin privileges. This lets a read-only or schema-level user bypass the scripting gate intended to restrict JavaScript execution to users with UPDATE_SECURITY. The result is unauthorized host-code execution through SQL-defined JavaScript functions, which can be used to run attacker-supplied script logic inside the server process.

Notes

• DEFINE FUNCTION ... LANGUAGE js was reachable through the SQL command API without the scripting gate, so the vulnerable path let a database-authorized but non-security-admin user register JavaScript and then invoke it later with SELECT. SQL and Cypher user functions were not part of that gap; the issue was specific to scripting-language libraries.
• The exposed polyglot context also allowed built-in load(path|url) usage, so deployments that relied on the default JavaScript host sandbox were additionally exposed to file reads, SSRF, or remote-script inclusion through that same route.

Workarounds

• Restrict access to DEFINE FUNCTION ... LANGUAGE js so only users with UPDATE_SECURITY can run it, and do not allow schema-level or read-only roles to create JavaScript functions; this blocks the SQL path that could otherwise be used to execute attacker-supplied JavaScript.
• If you expose trigger-based JavaScript execution, remove java.lang.* from the trigger script host-class allow-list so trigger scripts cannot resolve Java.type("java.lang.Runtime"), ProcessBuilder, or System.exit; this prevents OS command execution through trigger scripts.
• Limit exposure of the /api/v1/server settings endpoint to trusted administrators, because it can disclose sensitive configuration values such as the HA cluster token; this prevents leaking secrets that could be reused for cluster-forwarded-auth impersonation.
• Require database-scoped authorization on the time-series, batch, Prometheus, and Grafana HTTP routes, and deny requests for databases the authenticated user is not explicitly allowed to access; this blocks cross-database read/write access through those endpoints.

Upgrade com.arcadedb:arcadedb-engine to version 26.7.2 or higher.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through IMPORT DATABASE in ImportDatabaseStatement, SourceDiscovery, and the import source handlers. An authenticated SQL user can trigger the flaw by supplying an IMPORT DATABASE URL or path that points to a remote internal address or a local file, causing the server to fetch attacker-chosen content and import it as records. This lets the attacker reach internal services such as cloud metadata endpoints or read files like /etc/passwd from the server process. The result is exposure of internal network responses and local file contents to the user through the database import output.

Notes

• IMPORT DATABASE is exposed over the SQL command/query endpoints, not the server administration API; the maintainer advisory says /api/v1/server was already root-only and unaffected.
• Local-file imports are gated by the optional arcadedb.server.security.importAllowedLocalPaths allow-list; when it is set, file:// and plain-path sources are restricted to the configured directories, while classpath:// resources remain permitted.

Workarounds

• Restrict SQL command/query access to trusted administrative users; do not grant IMPORT DATABASE capability to untrusted accounts, which prevents authenticated non-admin users from triggering SSRF to internal endpoints or reading local files through the import path.

Upgrade com.arcadedb:arcadedb-engine to version 26.6.1 or higher.