ArcadeDB before version 26.7.2 allows an authenticated user with UPDATE_SCHEMA permission to create a JavaScript trigger that can reference classes in the java.lang package because the trigger engine adds that package to the list of allowed imports. An attacker can craft a trigger that calls java.lang.Runtime.getRuntime().exec() or uses ProcessBuilder, causing arbitrary operating‑system commands to run when the trigger fires. This flaw maps to CWE‑94, a code injection weakness, and results in full compromise of the system where the database is deployed.

All installations of ArcadeData ArcadeDB that run the arcade‑engine component before 26.7.2 are affected. No other products or vendor versions are listed, so the risk is confined to the upstream database engine.

The vulnerability scores a CVSS of 9.3, indicating critical severity. EPSS data is not available, but the flaw requires only legitimate UPDATE_SCHEMA rights, which many administrators grant. The flaw is not in the CISA KEV catalog, so there is no current known exploitation record, yet the impact is large. An attacker can activate the trigger through normal database operations, making exploitation straightforward in a trusted internal environment.