Summary
ArcadeDB trigger scripts before 26.7.2 allow JavaScript triggers to resolve classes in the java.lang package and invoke Runtime or ProcessBuilder APIs.
An authenticated user with UPDATE_SCHEMA permission can craft a trigger that executes OS commands when the trigger fires, leading to critical server compromise.
Affected context
This vulnerability affects ArcadeDB deployments that:
- Enable and use JavaScript-based trigger scripts for schema or data events
- Run the database server with permissions sufficient to execute OS-level commands
- Grant UPDATE_SCHEMA or similar elevated roles to application users or administrators
The risk is most pronounced where schema-level accounts are accessible from shared environments, CI/CD pipelines, or multi-tenant administrative consoles.
Exploit preconditions
- Attack surface: Authenticated access to ArcadeDB with the ability to define or modify trigger scripts.
- Required access: UPDATE_SCHEMA permission or equivalent privileges to create or alter JavaScript triggers.
- Trigger point: Execution of the crafted trigger during normal database operations (e.g., inserts, updates, or schema changes).
- Why exploitation is possible: ScriptTriggerExecutor explicitly whitelists
java.lang.*, allowing script-based lookup of core Java classes, includingRuntimeand process management APIs, which can then be invoked from the trigger context.
Why this happens
The core issue stems from overly permissive integration between the embedded scripting engine and the Java runtime.
ScriptTriggerExecutor adds java.lang.* to the set of allowed packages, exposing powerful classes like java.lang.Runtime and ProcessBuilder directly to user-defined JavaScript triggers.
This embodies CWE-94: Improper Control of Code Generation, where user-controllable scripts operate in a context with access to dangerous execution primitives, enabling arbitrary OS command execution instead of being constrained to safe, domain-specific operations.
Potential impact
- Execution of arbitrary OS commands under the ArcadeDB server's operating system account
- Full compromise of the database server host, including data theft or destruction
- Installation of backdoors or pivoting to other systems reachable from the database server
- Disruption of service availability through destructive or resource-exhausting commands
General mitigation guidance
Mitigation focuses on constraining script execution environments and minimizing exposure of host runtime APIs.
Common defensive patterns include:
- Restricting or eliminating direct access to core runtime packages (e.g.,
java.lang.*) from user-defined scripts - Applying sandboxing or whitelisting that only exposes a minimal, domain-specific API surface to triggers
- Designing trigger mechanisms to operate on declarative rules rather than arbitrary scripting where feasible
- Limiting powerful schema-modifying permissions (like UPDATE_SCHEMA) to tightly controlled, audited accounts
- Running the database service with least-privilege OS accounts and additional OS-level confinement (such as containers or mandatory access controls) to reduce the blast radius if scripts are abused
How teams detect issues like this
Detection typically combines configuration review, script inspection, and runtime monitoring:
- Static review or automated scanning of trigger definitions for references to host runtime classes, process invocation APIs, or other high-risk constructs
- Security-focused code review of database automation, migrations, and schema management scripts that define or alter triggers
- Policy checks in CI/CD pipelines to prevent deployment of triggers containing access to general-purpose Java packages
- Monitoring of database logs for unusual trigger behavior, such as errors arising from attempted process execution or anomalous timing correlated with system-level events
- System-level observability (process creation logs, command auditing) to detect unexpected processes spawned by the database service account
