DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-X9F9-R4M8-9XC2: GHSA-x9f9-r4m8-9xc2: Remote Code Execution via GraalVM Polyglot Sandbox Bypass in ArcadeDB Trigger Scripts

#security #cve #cybersecurity #ghsa

GHSA-x9f9-r4m8-9xc2: Remote Code Execution via GraalVM Polyglot Sandbox Bypass in ArcadeDB Trigger Scripts

Vulnerability ID: GHSA-X9F9-R4M8-9XC2
CVSS Score: 8.4
Published: 2026-07-16

ArcadeDB is an open-source, multi-model database engine supporting graph, document, key-value, and vector models. In affected versions of ArcadeDB, the trigger script executor improperly configures GraalVM scripting engine permissions. By allowing the 'java.lang.*' package to be loaded within the scripting context, the sandbox environment can be bypassed. An authenticated user with schema administration privileges ('UPDATE_SCHEMA') can register a malicious script trigger that executes arbitrary Java host classes, leading to unauthenticated remote command execution under the context of the ArcadeDB server process.

TL;DR

An input validation and sandbox configuration vulnerability in ArcadeDB's script execution engine allows authenticated database users with schema modification privileges to execute arbitrary operating system commands by bypassing the GraalVM polyglot container using direct Java host class reflection.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94 (Improper Control of Generation of Code)
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 8.4 (High)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed
  • Affected Component: ScriptTriggerExecutor.java
  • Prerequisite Privileges: UPDATE_SCHEMA (High)

Affected Systems

  • ArcadeDB Server
  • com.arcadedb:arcadedb-engine (Maven package)
  • arcadedb-engine: >= 21.9.1, < 26.7.2 (Fixed in: 26.7.2)

Exploit Details

  • GitHub: The advisory details the syntax for creating the exploit trigger bypassing the GraalVM scripting sandbox using Java.type reflection statements.

Mitigation Strategies

  • Upgrade the ArcadeDB engine dependency to version 26.7.2 or higher
  • Disable JavaScript and polyglot scripting engines in the server configuration if custom script triggers are not required
  • Implement runtime egress network filtering on the database host to block unauthorized outbound socket connections initiated by the server process

Remediation Steps:

  1. Identify all projects importing 'com.arcadedb:arcadedb-engine' and update the dependency version to '26.7.2' in pom.xml or build.gradle files
  2. Scan existing database schemas for custom triggers using 'SELECT FROM Schema' to identify unauthorized JS trigger registrations
  3. Revoke 'UPDATE_SCHEMA' permissions from any database user accounts that do not strictly require structural administrative access
  4. Apply operating system firewalls to prevent the database service from communicating with external, untrusted internet destinations

References

Read the full report for GHSA-X9F9-R4M8-9XC2 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)