PT-2026-60946 · Surrealdb+1 · Surrealdb+1

Akkie · CVE-2024-58366 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.1.1

Description A format string issue exists in the Exception::throw type() function of rquickjs, the Rust binding to the QuickJS engine, when scripting is enabled. Attackers with scripting privileges can provide format string sequences in error inputs to read arbitrary process memory or execute code with the privileges of the SurrealDB process.

Recommendations Update to version 1.1.1 or later.

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2024-58366

Affected Products

Surrealdb

Quickjs

References · 5

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58366 · Security Note
• https://twitter.com/UpwindMDR/status/2078527274396053851 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2078530716711682355 · Twitter Post
• https://vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions · Note