{"items":[{"id":"NVI-00013845","kind":"vulnerability","title":"SurrealDB server-takeover via SurrealQL injection on backup import","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-ccj3-5p93-8p42","CVE-2025-71392"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb, surrealdb, surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0eaaa00cf48b4be2655b58983a785799"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0eaaa00cf48b4be2655b58983a785799","url":"https://github.com/advisories/GHSA-ccj3-5p93-8p42","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-ccj3-5p93-8p42","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0eaaa00cf48b4be2655b58983a785799"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"The SurrealDB command-line tool allows exporting databases through the `export` command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported.\n\nFor the injection to occur, an authenticated System User with `OWNER` or `EDITOR` roles needs to create tables or fields with malicious names containing SurrealQL, subsequently exported using the `export` operation\n\nThe attacker could achieve a privilege escalation and root level access to the SurrealDB instance if a higher privileged user subsequently performs the `import` operation. \n\nFurthermore, applications using SurrealDB that allow its users to define custom fields or tables are at risk of a universal second order SurrealQL injection, even if query parameters are properly sanitized. \n\nThis issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53, the severity defined within cure53's preliminary finding is Critical, matched by our CVSS v4 assessment.\n\n### Impact\nThis attack can be used to perform privilege escalation and complete takeover (root access) of the SurrealDB instance, as well as being able to","public_affected_ranges":[">= 2.2.0, < 2.2.2"]},{"certainty":"source_listed","source_ids":["sr-0eaaa00cf48b4be2655b58983a785799"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"The SurrealDB command-line tool allows exporting databases through the `export` command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported.\n\nFor the injection to occur, an authenticated System User with `OWNER` or `EDITOR` roles needs to create tables or fields with malicious names containing SurrealQL, subsequently exported using the `export` operation\n\nThe attacker could achieve a privilege escalation and root level access to the SurrealDB instance if a higher privileged user subsequently performs the `import` operation. \n\nFurthermore, applications using SurrealDB that allow its users to define custom fields or tables are at risk of a universal second order SurrealQL injection, even if query parameters are properly sanitized. \n\nThis issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53, the severity defined within cure53's preliminary finding is Critical, matched by our CVSS v4 assessment.\n\n### Impact\nThis attack can be used to perform privilege escalation and complete takeover (root access) of the SurrealDB instance, as well as being able to","public_affected_ranges":[">= 2.1.0, < 2.1.5"]},{"certainty":"source_listed","source_ids":["sr-0eaaa00cf48b4be2655b58983a785799"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"The SurrealDB command-line tool allows exporting databases through the `export` command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported.\n\nFor the injection to occur, an authenticated System User with `OWNER` or `EDITOR` roles needs to create tables or fields with malicious names containing SurrealQL, subsequently exported using the `export` operation\n\nThe attacker could achieve a privilege escalation and root level access to the SurrealDB instance if a higher privileged user subsequently performs the `import` operation. \n\nFurthermore, applications using SurrealDB that allow its users to define custom fields or tables are at risk of a universal second order SurrealQL injection, even if query parameters are properly sanitized. \n\nThis issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53, the severity defined within cure53's preliminary finding is Critical, matched by our CVSS v4 assessment.\n\n### Impact\nThis attack can be used to perform privilege escalation and complete takeover (root access) of the SurrealDB instance, as well as being able to","public_affected_ranges":["< 2.0.5"]}],"null_published_at":"2026-11-02T10:00:37.158Z","source_updated_at":"2026-09-04T19:36:34.000Z","source_disclosed_at":"2025-04-11T14:07:34.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:20:52.377Z"}],"next_cursor":null,"snapshot_revision":"42594"}