Arcadedata - Arcadedb - CRITICAL - CVE-2026-67340. A vulnerability in ArcadeDB prior to version 26.7.2 allows an authenticated user with UPDATE_SCHEMA permission to create a JavaScript trigger that can execute arbitrary operating system commands. This is possible due to the inclusion of java.lang.* in the allowed packages by the ScriptTriggerExecutor. When this trigger is invoked, it can utilize methods such as java.lang.Runtime.getRuntime().exec() or ProcessBuilder, creating potential risks for system integrity and security.