ArcadeDB versions before 26.10.1 allow a remote code execution issue because the Gremlin Groovy engine can run arbitrary Groovy scripts without proper authorization checks on the command endpoint. An attacker who is authenticated to the database, even with a read‑only role, can submit a request to the /api/v1/command/{database} endpoint while the Groovy engine is enabled and cause the server process to execute operating‑system commands. This flaw stems from missing script‑level authorization in GremlinQueryEngine.command(), classified as CWE‑863.

Any installation of ArcadeData ArcadeDB older than version 26.10.1, including the default community release, is affected. The vulnerability applies to all database instances that have the Gremlin Groovy engine enabled and accept REST commands.

The CVSS score of 7.7 indicates a high‑severity vulnerability. The EPSS score of less than 1% shows a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated to the ArcadeDB instance; once authenticated, the presence of a read‑only role still permits command execution. Exploitation would allow the attacker to run arbitrary OS commands on the server, fully compromising the system’s confidentiality, integrity, and availability.