A critical code injection vulnerability in ArcadeDB allows authenticated users with specific permissions to achieve remote code execution on the underlying host.

This vulnerability involves improper control of code generation where the ScriptTriggerExecutor fails to restrict access to sensitive Java classes. An authenticated user with UPDATE_SCHEMA privileges can leverage this to invoke system-level commands through JavaScript triggers.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the database process. This poses a severe risk of full system compromise, data exfiltration, or the installation of persistent backdoors. Given the CVSS score of 9.8, this flaw represents a critical threat to the confidentiality, integrity, and availability of the affected environment.

Immediate Action: Upgrade the arcadedb-engine component to version 26.7.2 or later to resolve the script execution flaw.

Proactive Monitoring: Audit database schemas for suspicious trigger scripts that utilize the java.lang package or attempt to invoke system processes.

Compensating Controls: Restrict database administrative access to trusted personnel and implement network-level egress filtering to prevent the database server from reaching unauthorized external resources.

Public Exploit Available: Unknown

This vulnerability presents a high risk of remote code execution and requires immediate attention. Administrators must prioritize updating the arcadedb-engine to version 26.7.2 immediately to neutralize the injection vector and prevent potential system takeover.