ArcadeDB versions prior to 26.8.1, specifically all releases up to and including 26.7.3, allow an attacker who has authenticated to the database with any role—including read‑only—to execute arbitrary operating system commands. The vulnerability arises from the Gremlin query engine, which silently falls back from the secure gremlin‑lang parser to the insecure Groovy scripting engine whenever a query fails to parse. Because the fallback accepts Groovy code, a crafted parameterized query can run commands as the ArcadeDB server process user. This is an instance of code injection (CWE‑94) and results in full remote code execution, enabling complete control over the host.

ArcadeData’s ArcadeDB is affected for all releases up to and including 26.7.3, and the issue is fixed in version 26.8.1 and newer, where the Groovy fallback has been removed. Users should verify they are running a patched release 26.8.1 or later.

The CVSS base score of 8.7 reflects high severity. The EPSS score is not publicly available, and the vulnerability is not listed in CISA’s KEV catalog, so the current exploitation likelihood is unknown. However, any authenticated user, even one with a read‑only role, can trigger the exploit. Once executed, an attacker can run arbitrary system commands, leading to full compromise of the host and enabling lateral movement, thus posing significant confidentiality, integrity, and availability risks.