Attack Chain

1. An attacker gains UPDATE_SCHEMA administrative privileges within an ArcadeDB instance.
2. The attacker crafts a malicious database trigger script that includes an OS command execution payload.
3. The attacker registers this malicious trigger within ArcadeDB using the CREATE TRIGGER ... EXECUTE JAVASCRIPT command.
4. The JavaScript payload within the trigger leverages the permissive java.lang.* allow-list to call Java.type("java.lang.Runtime").getRuntime().exec(...).
5. The crafted trigger is saved into the database schema, awaiting its activation conditions.
6. A subsequent database operation or event occurs that satisfies the conditions for the newly created malicious trigger to fire.
7. The ArcadeDB ScriptTriggerExecutor processes the trigger, and due to java.lang.* being in the allow-list, the java.lang.Runtime.exec() call is permitted.
8. The attacker's specified operating system commands are executed on the host server with the privileges of the ArcadeDB process, achieving remote code execution.

Impact

Successful exploitation of this vulnerability results in arbitrary remote code execution on the server hosting ArcadeDB. This allows an attacker to completely compromise the underlying operating system, potentially leading to data exfiltration, deletion, or modification of any data accessible by the ArcadeDB process. While it requires an attacker to first obtain UPDATE_SCHEMA privileges, the RCE then allows for privilege escalation from a schema administrator role to full system control. The compromise can affect any operating system ArcadeDB is deployed on, including Windows, Linux, and macOS.

Recommendation

• Upgrade ArcadeDB installations immediately to version 26.7.2 or later to apply the official patch.
• Review and ensure strict access controls are in place for users assigned UPDATE_SCHEMA privileges.
• Administrators should monitor database logs for suspicious CREATE TRIGGER statements that include JAVASCRIPT execution.