Information Exposure Affecting surrealdb package, versions <3.1.0-beta.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Information Exposure vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUST-SURREALDB-17797656
- published2 Jul 2026
- disclosed1 Jul 2026
- creditUnknown
Introduced: 1 Jul 2026
New CVE NOT AVAILABLE CWE-209 (opens in a new tab)How to fix?
Upgrade surrealdb to version 3.1.0-beta.1 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure via error messages when performing an incompatible operation on a field hidden by field-level SELECT permissions. An attacker can obtain the value of hidden fields by triggering an error during an UPDATE operation and reading the sensitive data exposed in the resulting error message. This is only exploitable if the attacker has UPDATE access to records with fields hidden by field-level SELECT permissions.
Workaround
This vulnerability can be mitigated by not granting UPDATE permission on records whose field-level SELECT permissions are expected to hide values from the same caller.