ArcadeDB versions before 26.7.2 contain a critical vulnerability in the arcadedb-engine component where the ScriptTriggerExecutor incorrectly adds java.lang.* to the allowed packages for trigger scripts. This allows an authenticated user with UPDATE_SCHEMA permission to create a malicious JavaScript trigger that leverages Java.type to access host classes such as java.lang.Runtime or ProcessBuilder. When the trigger fires, the attacker can execute arbitrary OS commands on the underlying host system. The vulnerability effectively enables remote code execution for any authenticated user with schema update privileges. A patch is available in ArcadeDB version 26.7.2 and later. The issue has been documented in a GitHub security advisory and tracked by VulnCheck.