CVE-2024-58366

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

Scoring

Severity

CRITICAL

CVSS base score

9

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS probability

0.32%

CWE

CWE-134

Published

2026-07-18

Last modified

2026-07-28

Affected products

• surrealdb surrealdb
• surrealdb surrealdb
• surrealdb surrealdb

Weakness type

• CWE-134

Related vulnerabilities

• CVE-2026-69395 — Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability
• CVE-2026-16821 — Vulnerabilities in IBM AIX and PowerVM VIOS
• CVE-2026-81574 — Format String Vulnerability in Logger
• CVE-2026-63073 — Untrusted Sender DN Used as Format String in CMP Response Validation
• CVE-2026-17136 — Vulnerabilities in IBM AIX and PowerVM VIOS
• CVE-2026-68553 — Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command
• CVE-2026-15961 — Power System Information Disclosure
• CVE-2026-12004 — Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Markdown version · Browse all CVEs