CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export
Authenticated users can inject SurrealQL via malicious table names, leading to privilege escalation and root takeover when backups are imported.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-71392?
CVE-2025-71392 is a critical code injection vulnerability in Surrealdb Surrealdb, published on 18 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.
Weakness: CWE-77
Which versions are affected by CVE-2025-71392?
6 open source packages ship an affected version, including surrealdb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
surrealdb crates.io | All versions | 2.0.5 |
surrealdb crates.io | All versions | 2.0.5 |
surrealdb crates.io | From 2.1.0 | 2.1.5 |
surrealdb crates.io | From 2.1.0 | 2.1.5 |
surrealdb crates.io | From 2.2.0 | 2.2.2 |
surrealdb crates.io | From 2.2.0 | 2.2.2 |
Products include Surrealdb Surrealdb.
How do I fix CVE-2025-71392?
Upgrade surrealdb to a fixed version for your release line: 2.0.5, 2.1.5 or 2.2.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-71392 being exploited?
There is no known exploitation of CVE-2025-71392 in the wild and no public exploit code.
Other vulnerabilities in Surrealdb Surrealdb
- CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
- CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
- CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
- CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
- CVE-2023-54366 SurrealDB before 1.0.1 Insecure Default Table Permissions
Sources
Also known as GHSA-ccj3-5p93-8p42.