Skip to content
Threat Feed
Subscribe

Product

Arcadedb-Engine (< 26.7.2)

1 brief RSS
high advisory

ArcadeDB Trigger Script RCE via Java.lang.* Allow-list

A vulnerability in ArcadeDB's ScriptTriggerExecutor allows users with UPDATE_SCHEMA privileges to achieve OS Remote Code Execution (RCE) due to a permissive allow-list for trigger scripts, enabling direct calls to `java.lang.Runtime.exec()` when a malicious trigger script is created and fired.

arcadedb-engine ArcadeDB RCE vulnerability java database privilege-escalation SSRF DoS +2
3t