CVE-2026-67340

ArcadeDB prior to 26.7.2 (arcadedb-engine) is affected: ScriptTriggerExecutor adds java.lang.* to allowed packages, allowing trigger scripts to access host classes via Java.type. An authenticated user with UPDATE_SCHEMA can create a JavaScript trigger that calls java.lang.Runtime.getRuntime().exe...