{"id":"CVE-2024-58366","aliases":["EUVD-2024-55682","GHSA-q3gg-m8hr-h4x4","GHSA-qcfm-cmfw-f4x4"],"status":"published","title":"SurrealDB before 1.1.1 Format String via Scripting Functions","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","severity":{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00575,"percentile":0.47725,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2024-02-21T00:04:05Z","modified":"2026-10-31T02:30:53Z","fixes":[{"ecosystem":"crates.io","package":"surrealdb","fixed_in":["1.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"surrealdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"surrealdb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]}],"products":[{"vendor":"delskayn","product":"rquickjs"},{"vendor":"surrealdb","product":"surrealdb"}],"references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://github.com/surrealdb/surrealdb/issues/3327","tags":["web"]},{"url":"https://github.com/surrealdb/surrealdb/pull/3332","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q3gg-m8hr-h4x4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58366","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qcfm-cmfw-f4x4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58366.json","tags":["advisory"]},{"url":"https://github.com/surrealdb/surrealdb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-58366","title":"SurrealDB before 1.1.1 Format String via Scripting Functions","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","status":"published","published":"2026-07-18T13:10:06.939Z","modified":"2026-10-29T21:15:09.355Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-55682","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","status":"published","published":"2026-07-18T13:10:06Z","modified":"2026-10-29T21:15:09Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T16:59:14.591479Z"}],"ghsa":[{"id":"GHSA-q3gg-m8hr-h4x4","title":"Externally Controlled Format String in Scripting Functions","description":"The `rquickjs` crate used by SurrealDB implements Rust bindings to the QuickJS C library and is used to execute SurrealDB scripting functions. The `rquickjs` function `Exception::throw_type` takes a string and returns an error object. Prior to version `0.4.2` of the crate, this string would be fed directly into `printf`, which will receive the error string as a format string with no additional arguments, leading to undefined behavior. This issue triggers when a SurrealDB scripting function returns an error and its input contains a format string such as `%s` or `%d`. \n\nThis vulnerability can only affect SurrealDB servers explicitly enabling the scripting capability with `--allow-scripting` or `--allow-all` and equivalent environment variables `SURREAL_CAPS_ALLOW_SCRIPT=true` and `SURREAL_CAPS_ALLOW_ALL=true`.\n\n### Impact\n\nAn attacker with privileges to execute scripting functions with arbitrary inputs may be able to exploit this format string vulnerability in order read arbitrary memory from the remote SurrealDB process. A format string vulnerability may also be further exploited to execute arbitrary code with the privileges of the SurrealDB process.\n\nThe fact that error messages are limited to 256 bytes coupled with [exploit mitigation features supported in Rust executables](https://doc.rust-lang.org/rustc/exploit-mitigations.html#exploit-mitigations-1) may somewhat increase the complexity of exploiting this vulnerability to reliably achieve remote code execution in practice.\n\n### Patches\n\n- Version 1.1.1 and later are not affected by this issue.\n\n### Workarounds\n\nUsers unable to update should restrict access from untrusted users to define and execute scripting functions. This can be achieved by removing the scripting capability by default or with `--deny-scripting` and equivalent environment variable `SURREAL_CAPS_DENY_SCRIPT=true`. If not possible, network access should be limited to trusted users.\n\n### References\n\n- https://github.com/surrealdb/surrealdb/issues/3327\n- https://github.com/surrealdb/surrealdb/pull/3332\n- https://github.com/DelSkayn/rquickjs/pull/247","status":"published","published":"2024-02-21T00:04:05Z","modified":"2024-02-21T00:04:06Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:37:38.20753Z"},{"id":"GHSA-qcfm-cmfw-f4x4","title":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception:...","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","status":"published","published":"2026-07-18T15:31:49Z","modified":"2026-07-18T15:31:56Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:09:35.806108Z"}],"nvd":[{"id":"CVE-2024-58366","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","status":"published","published":"2026-07-18T14:17:09.6Z","modified":"2026-10-29T21:17:03.447Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:10:47.77313Z"}],"osv":[{"id":"CVE-2024-58366","title":"SurrealDB before 1.1.1 Format String via Scripting Functions","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","status":"published","published":"2026-07-18T13:10:06.939Z","modified":"2026-10-31T02:30:53.781235469Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"GHSA-q3gg-m8hr-h4x4","title":"Externally Controlled Format String in Scripting Functions","description":"The `rquickjs` crate used by SurrealDB implements Rust bindings to the QuickJS C library and is used to execute SurrealDB scripting functions. The `rquickjs` function `Exception::throw_type` takes a string and returns an error object. Prior to version `0.4.2` of the crate, this string would be fed directly into `printf`, which will receive the error string as a format string with no additional arguments, leading to undefined behavior. This issue triggers when a SurrealDB scripting function returns an error and its input contains a format string such as `%s` or `%d`. \n\nThis vulnerability can only affect SurrealDB servers explicitly enabling the scripting capability with `--allow-scripting` or `--allow-all` and equivalent environment variables `SURREAL_CAPS_ALLOW_SCRIPT=true` and `SURREAL_CAPS_ALLOW_ALL=true`.\n\n### Impact\n\nAn attacker with privileges to execute scripting functions with arbitrary inputs may be able to exploit this format string vulnerability in order read arbitrary memory from the remote SurrealDB process. A format string vulnerability may also be further exploited to execute arbitrary code with the privileges of the SurrealDB process.\n\nThe fact that error messages are limited to 256 bytes coupled with [exploit mitigation features supported in Rust executables](https://doc.rust-lang.org/rustc/exploit-mitigations.html#exploit-mitigations-1) may somewhat increase the complexity of exploiting this vulnerability to reliably achieve remote code execution in practice.\n\n### Patches\n\n- Version 1.1.1 and later are not affected by this issue.\n\n### Workarounds\n\nUsers unable to update should restrict access from untrusted users to define and execute scripting functions. This can be achieved by removing the scripting capability by default or with `--deny-scripting` and equivalent environment variable `SURREAL_CAPS_DENY_SCRIPT=true`. If not possible, network access should be limited to trusted users.\n\n### References\n\n- https://github.com/surrealdb/surrealdb/issues/3327\n- https://github.com/surrealdb/surrealdb/pull/3332\n- https://github.com/DelSkayn/rquickjs/pull/247","status":"published","published":"2024-02-21T00:04:05Z","modified":"2026-07-19T03:56:47.888953236Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}