CVE-2024-58366

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4	Vendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:delskayn:rquickjs::::::rust::*
	cpe:2.3:a:surrealdb:surrealdb::::::::

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) SurrealDB anterior a la versión 1.1.1 contiene una vulnerabilidad de cadena de formato en la función rquickjs Exception::throw_type cuando el scripting está habilitado. Atacantes con privilegios de scripting pueden proporcionar secuencias de cadena de formato en entradas de error para leer memoria arbitraria o ejecutar código con privilegios de proceso de SurrealDB.

Information

Published : 2026-07-18 14:17

Updated : 2026-10-29 21:17

NVD link : CVE-2024-58366

Mitre link : CVE-2024-58366

CVE.ORG link : CVE-2024-58366

JSON object : View

Products Affected

surrealdb

surrealdb

delskayn

rquickjs

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2024-58366", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58366", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-20T15:13:39.140208Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.1", "versionType": "semver"}, {"status": "unaffected", "version": "1.1.1", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}, {"vendor": "DelSkayn", "product": "rquickjs", "versions": [{"status": "affected", "version": "0", "lessThan": "0.4.2", "versionType": "semver"}, {"status": "unaffected", "version": "0.4.2", "versionType": "semver"}], "packageURL": "pkg:cargo/rquickjs", "defaultStatus": "unaffected"}]}], "published": "2026-07-18T14:17:09.600", "references": [{"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges."}, {"lang": "es", "value": "SurrealDB anterior a la versi\u00f3n 1.1.1 contiene una vulnerabilidad de cadena de formato en la funci\u00f3n rquickjs Exception::throw_type cuando el scripting est\u00e1 habilitado. Atacantes con privilegios de scripting pueden proporcionar secuencias de cadena de formato en entradas de error para leer memoria arbitraria o ejecutar c\u00f3digo con privilegios de proceso de SurrealDB."}], "lastModified": "2026-10-29T21:17:03.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:delskayn:rquickjs:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "B44EA40E-E1B0-405E-8A3E-106668D7E3C7", "versionEndExcluding": "0.4.2"}, {"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DECFCFFE-983C-4D0B-998D-4EB5310BD792", "versionEndExcluding": "1.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}