GHSA-x9f9-r4m8-9xc2

Suggest an improvement
Source
https://github.com/advisories/GHSA-x9f9-r4m8-9xc2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-x9f9-r4m8-9xc2/GHSA-x9f9-r4m8-9xc2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-x9f9-r4m8-9xc2
Aliases
Published
2026-07-16T20:15:36Z
Modified
2026-08-02T03:56:46Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
Details

ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. (ScriptTriggerExecutor.java:56); trigger creation is gated only at UPDATE_SCHEMA (LocalSchema.createTrigger:636). Permitting java.lang.* host-class lookup lets a trigger script do Java.type("java.lang.Runtime").getRuntime().exec(...) (or ProcessBuilder). The reflection denylist does not block Java.type host lookups, and allowCreateProcess(false) only restricts GraalVM's guest process API, not a host Runtime.exec reached through HostAccess.ALL.

Exploit: a user with UPDATE_SCHEMA (schema admin, strictly less than security admin) runs CREATE TRIGGER ... EXECUTE JAVASCRIPT '<runtime.exec>' and obtains OS RCE when the trigger fires.

Fix: remove java.lang.* (and narrow the rest) from the trigger allow-list; if host interop is needed, expose an explicit @HostAccess.Export API surface instead of whole packages; consider gating trigger creation at UPDATE_SECURITY. Prefer an allow-list (HostAccess.EXPLICIT) over the current denylist-over-HostAccess.ALL.

Related medium/low items to fold into the fix: IMPORT DATABASE SSRF via unfollowed-redirect re-validation (SourceDiscovery.java:113), BACKUP/EXPORT DATABASE missing authorization (BackupDatabaseStatement.java:56, ExportDatabaseStatement.java:52), chunked-transfer body-size DoS bypass (HttpServer.java:301,318-333), and no brute-force lockout on password auth (ServerSecurity.java:189-205).

Database specific 
{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-16T20:15:36Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Maven / com.arcadedb:arcadedb-engine

Package

Name
com.arcadedb:arcadedb-engine
View open source insights on deps.dev
Purl
pkg:maven/com.arcadedb/arcadedb-engine

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
26.7.2

Affected versions

21.*
21.9.1-beta
21.9.1
21.10.1
21.10.2
21.11.1
21.12.1
22.*
22.1.1
22.1.2
22.1.3
22.2.1
22.8.1
22.9.1
22.10.1
22.11.1
22.12.1
23.*
23.1.1
23.1.2
23.2.1
23.3.1
23.4.1
23.5.1
23.6.1
23.7.1
23.9.1
23.10.1
23.11.1
23.12.1
23.12.2
24.*
24.1.1
24.2.1
24.4.1
24.5.1
24.6.1
24.10.1
24.11.1
24.11.2
25.*
25.1.1
25.2.1
25.3.1
25.3.2
25.4.1
25.5.1
25.6.1
25.7.1
25.8.1
25.9.1
25.10.1
25.11.1
25.12.1
26.*
26.1.1
26.2.1
26.2.2
26.3.1
26.3.2
26.4.2
26.5.1
26.6.1
26.7.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-x9f9-r4m8-9xc2/GHSA-x9f9-r4m8-9xc2.json"