CVE-2024-58366: SurrealDB before 1.1.1 Format String via Scripting Functions

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-18 · updated 2026-10-27
Weakness: CWE-134

Description

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

Affected products

Delskayn Rquickjs: before 0.4.2 — fixed in 0.4.2
surrealdb: before 1.1.1 — fixed in 1.1.1

How to fix

Upgrade to a fixed version: Delskayn Rquickjs 0.4.2; surrealdb 1.1.1. Check the vendor advisory for mitigations.

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4
https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions

Get alerted when CVE-2024-58366 or the next vulnerability affects your stack