GHSA-m9qr-4rcq-3jhc

dbs::Executor drives every SurrealQL statement through reblessive::tree::TreeStack. In reblessive 0.4.3 the runtime types unconditionally assert Send/Sync (unsafe impl Send/Sync for Stack, TreeStack and Runner), while the public entry points accept any future without a Send bound and store it type-erased in a bump allocator.

Two safe-code consequences follow. First, Runner::step_async/finish_async return driver futures tied to the stack borrow rather than to &mut self, so a driver future can be duplicated; because Stack is Sync those futures are Send, and polling two copies on different threads runs drive_top_task concurrently — racy Cell/UnsafeCell access, double pop_task()/pop_dealloc() (double drop / double free) and a non-atomic Option::take. Second, TreeStack: Send lets safe code move a driver whose type-erased future captures !Send state (Rc, RefCell) to another thread while the creating thread keeps an alias of that state.

No unsafe is needed at the call site. surrealdb-core's own query futures are Send only because of the unsound unsafe impl Send for TreeStack, while the captured &mut tree::Stk is deliberately !Send.

The unsound dependency was removed in 4.0.0 and the parser now uses plain recursion (commit 75407c4bcc).