CVE-2025-71392
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 fails to properly escape table and field names in the CLI export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious SurrealQL names; when a higher-privileged user imports the backup, the injected code executes, enabling privilege escalation and root-level takeover.
Risk Assessment
The organization faces privilege escalation and full takeover of the SurrealDB instance by an attacker with OWNER or EDITOR roles. Applications allowing users to define custom tables or fields are also exposed to universal second-order SurrealQL injection even with sanitized query parameters.
Recommendation
Immediately upgrade SurrealDB to version 2.0.5, 2.1.5, or 2.2.2 depending on your branch. Restrict assignment of OWNER and EDITOR roles and avoid allowing users to define custom table or field names.
Original NVD description (English source)
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.