Command Injection Affecting com.arcadedb:arcadedb-engine package, versions [,26.7.2)

Affected versions of this package are vulnerable to Command Injection through the ScriptTriggerExecutor in engine/src/main/java/com/arcadedb/schema/trigger/ScriptTriggerExecutor.java. An attacker can execute OS commands by creating a JavaScript trigger that uses Java.type("java.lang.Runtime").getRuntime().exec(...) or ProcessBuilder and then firing the trigger. The vulnerable trigger sandbox allowed java.lang.* host-class lookups for schema users with UPDATE_SCHEMA, so a malicious trigger script could access host methods and run system commands on the server. This breaks trigger execution isolation and lets a schema administrator obtain arbitrary command execution on the host.

Notes

• DEFINE FUNCTION ... LANGUAGE js is gated by UPDATE_SECURITY, not the usual schema-level mutation permission, so the RCE path is narrower than generic schema edits.
• The trigger exploit depends on GraalVM host-class lookup being enabled for java.lang.*; native JavaScript-only triggers remain unaffected.

• GitHub Commit 26.7.2
• Maintainer's Advisory