CVE-2024-58366

critical · 9

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

CVSS

0.3%

EPSS (exploit prob.)

25th

EPSS percentile

2026-07-18

Published

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-134

Affected products

Vendor	Product	Affected versions
delskayn	rquickjs	< 0.4.2
surrealdb	surrealdb	< 1.1.1

Check a specific version with /api/v1/cve/match.

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4
https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-58366