ArcadeDB Trigger Script Sandbox Escape Leading to Remote Code Execution

Technical Analysis

The vulnerability stems from an overly permissive sandbox configuration in ArcadeDB's JavaScript trigger execution engine, where java.lang.* classes are allowlisted for the Nashorn/GraalJS Java.type() bridge without restricting access to dangerous classes like Runtime and ProcessBuilder. An attacker with UPDATE_SCHEMA privileges can create a trigger (e.g., onAfterCreate, onAfterUpdate) containing script code such as Java.type('java.lang.Runtime').getRuntime().exec('command'), which executes with the privileges of the database process when the trigger condition is met. This is a classic scripting sandbox escape pattern common in embedded JVM script engines that expose reflection-capable type lookups. Given the 9.8 CVSS score, exploitation requires only schema-level authenticated access rather than full admin rights, significantly lowering the bar for attackers who have compromised a lower-privileged account. Organizations running AI agents that use ArcadeDB as a vector or graph database backend for RAG pipelines or agent memory stores are at direct risk: an agent or tool-use pipeline with schema-modification rights (or a compromised service account with such rights) could be manipulated into deploying this trigger, leading to full host compromise, credential/API key theft, and lateral movement into connected agent infrastructure.

Affected Systems

ArcadeDB engine (arcadedb-engine) versions prior to 26.7.2; any deployment where authenticated users are granted UPDATE_SCHEMA permission, including multi-tenant or shared ArcadeDB instances used as backend stores for applications, RAG pipelines, or agent frameworks.

Indicators of Compromise

• No specific file hashes, IPs, or domains published; indicators would be environment-specific — look for anomalous JavaScript triggers referencing Java.type('java.lang.Runtime') or 'java.lang.ProcessBuilder' in ArcadeDB schema/trigger definitions, unexpected child processes spawned by the ArcadeDB server process, and unauthorized schema modification events in audit logs.

Remediation Steps

1. 1

   Upgrade ArcadeDB

   Update all ArcadeDB deployments to version 26.7.2 or later, which restricts the ScriptTriggerExecutor's allowed package list to exclude dangerous java.lang classes like Runtime and ProcessBuilder.

2. 2

   Restrict UPDATE_SCHEMA permissions

   Audit and minimize the number of accounts and service identities (including AI agent service accounts) with UPDATE_SCHEMA permission; apply least-privilege principles.

3. 3

   Audit existing triggers

   Review all existing JavaScript triggers in ArcadeDB instances for suspicious use of Java.type, Runtime, ProcessBuilder, or other reflection-based OS interaction calls.

4. 4

   Monitor process execution

   Deploy host-based monitoring (EDR) on database servers to detect unexpected child processes spawned by the ArcadeDB service.

5. 5

   Network and credential hardening

   Isolate database servers from direct internet exposure and rotate any API keys or credentials accessible to the ArcadeDB process, especially those used by connected AI agent or RAG pipelines.