CVE-2024-58366 SurrealDB before 1.1.1 Format String via Scripting Functions
Attackers with scripting privileges can exploit a format string vulnerability in SurrealDB to read arbitrary memory or execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58366?
CVE-2024-58366 is a critical vulnerability in Surrealdb Surrealdb, published on 18 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.
Weakness: CWE-134
Which versions are affected by CVE-2024-58366?
2 open source packages ship an affected version, including surrealdb. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
surrealdb crates.io | All versions | 1.1.1 |
surrealdb crates.io | All versions | 1.1.1 |
Products include Delskayn Rquickjs, Surrealdb Surrealdb.
How do I fix CVE-2024-58366?
Upgrade surrealdb to 1.1.1 or later.
Is CVE-2024-58366 being exploited?
There is no known exploitation of CVE-2024-58366 in the wild and no public exploit code.
Sources
Also known as GHSA-q3gg-m8hr-h4x4, GHSA-qcfm-cmfw-f4x4.