{"answers":{"affected":"4 open source packages ship an affected version, including surrealdb. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-63762 in the wild and no public exploit code.","fix":"Upgrade surrealdb to a fixed version for your release line: 2.6.1 or 3.0.0-beta.3.","what":"CVE-2026-63762 is a medium-severity vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-63762 and fix it if it is affected.\n\nWhat it is: CVE-2026-63762 is a medium-severity vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-63762 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- surrealdb (crates.io): affected all versions; fixed in 2.6.1\n- surrealdb (crates.io): affected all versions; fixed in 2.6.1\n- surrealdb (crates.io): affected from 3.0.0-alpha.8; fixed in 3.0.0-beta.3\n- surrealdb (crates.io): affected from 3.0.0-alpha.8; fixed in 3.0.0-beta.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-63762/ (Markdown: https://insights.sbomify.com/CVE-2026-63762/index.md)","id":"CVE-2026-63762","markdown":"https://insights.sbomify.com/CVE-2026-63762/index.md","name":"CVE-2026-63762","record":{"aliases":["GHSA-hxgc-2rvh-7h4r","GHSA-xx7m-69ff-9crp"],"analysis":{"component_type":"database","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"SurrealDB database","requires_auth":"low_privilege","summary":"Attackers can crash the SurrealDB server by triggering a null pointer dereference in the JavaScript engine, requiring manual restarts.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[{"product":"surrealdb","vendor":"surrealdb"}],"cvss":{"score":6,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries — including unauthenticated guests when --allow-guests is enabled — can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"SurrealDB before v2.6.1 Denial of Service via scripting","id":"CVE-2026-63762","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":"surrealdb:surrealdb","products":["surrealdb:surrealdb"],"type":"null_dereference","year":"2026"},"n_packages":4,"n_references":2,"next":{"headline":"SurrealDB before 2.5.0 Privilege Escalation via Future Fields","id":"CVE-2026-63763"},"packages":[{"ecosystem":"crates.io","fixed":["2.6.1"],"introduced":["0"],"last_affected":[],"package":"surrealdb","purl":null,"source":"GHSA-xx7m-69ff-9crp"},{"ecosystem":"crates.io","fixed":["2.6.1"],"introduced":["0"],"last_affected":[],"package":"surrealdb","purl":"pkg:cargo/surrealdb","source":"GHSA-xx7m-69ff-9crp"},{"ecosystem":"crates.io","fixed":["3.0.0-beta.3"],"introduced":["3.0.0-alpha.8"],"last_affected":[],"package":"surrealdb","purl":null,"source":"GHSA-xx7m-69ff-9crp"},{"ecosystem":"crates.io","fixed":["3.0.0-beta.3"],"introduced":["3.0.0-alpha.8"],"last_affected":[],"package":"surrealdb","purl":"pkg:cargo/surrealdb","source":"GHSA-xx7m-69ff-9crp"}],"prev":{"headline":"SurrealDB before 3.1.0 Algorithm Downgrade via ES512","id":"CVE-2026-63761"},"products":["surrealdb"],"published":"2026-07-20","related":[{"cvss_score":9.4,"headline":"SurrealDB before 2.2.2 SurrealQL Injection via export","id":"CVE-2025-71392","kev_date_added":null,"published":"2026-07-18"},{"cvss_score":9.2,"headline":"SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition","id":"CVE-2026-63756","kev_date_added":null,"published":"2026-07-20"},{"cvss_score":8.7,"headline":"SurrealDB before 3.1.0 Denial of Service via malformed RPC use","id":"CVE-2026-63747","kev_date_added":null,"published":"2026-07-20"},{"cvss_score":8.7,"headline":"SurrealDB before 3.1.0 Session Hijacking via /rpc sessions","id":"CVE-2026-63757","kev_date_added":null,"published":"2026-07-20"},{"cvss_score":8.7,"headline":"SurrealDB before 3.1.0 Denial of Service via JSON Parser","id":"CVE-2026-63760","kev_date_added":null,"published":"2026-07-20"},{"cvss_score":8.7,"headline":"SurrealDB before 1.0.1 Insecure Default Table Permissions","id":"CVE-2023-54366","kev_date_added":null,"published":"2026-07-18"},{"cvss_score":8.7,"headline":"SurrealDB before 1.5.5 Query Injection via RPC API","id":"CVE-2024-58362","kev_date_added":null,"published":"2026-07-18"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-08","vendors":["surrealdb"]},"summary":"Attackers can crash the SurrealDB server by triggering a null pointer dereference in the JavaScript engine, requiring manual restarts.","url":"https://insights.sbomify.com/CVE-2026-63762/"}