CVE-2025-71392

Summary

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.

Affected Software

VendorProductVersion RangeStatus
surrealdbsurrealdb0 < 2.2.2affected
surrealdbsurrealdb2.2.2unaffected
surrealdbsurrealdb0 < 2.1.5affected
surrealdbsurrealdb2.1.5unaffected
surrealdbsurrealdb0 < 2.0.5affected
surrealdbsurrealdb2.0.5unaffected

Weaknesses

  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

References