ArcadeDB versions prior to 26.8.1, specifically all releases up to and including 26.7.3, allow an attacker who has authenticated to the database with any role—including read‑only—to execute arbitrary operating system commands. The vulnerability arises from the Gremlin query engine, which silently falls back from the secure gremlin‑lang parser to the insecure Groovy scripting engine whenever a query fails to parse. Because the fallback accepts Groovy code, a crafted parameterized query can run commands as the ArcadeDB server process user. This is an instance of code injection (CWE-94) and results in full remote code execution, enabling complete control over the host.

ArcadeData’s ArcadeDB is affected for all releases up to and including 26.7.3, and the issue is fixed in version 26.8.1 and newer, where the Groovy fallback has been removed. Users should verify they are running a patched release 26.8.1 or later.

The CVSS base score of 8.7 reflects high severity. EPSS indicates a very low exploitation probability of less than 1%. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation yet. Nevertheless, any authenticated user, even with read‑only access, can trigger the exploit. Once executed, an attacker can run arbitrary system commands as the ArcadeDB server process user, enabling full compromise of the host and facilitating lateral movement, and posing risks to confidentiality, integrity, and availability.