Arbitrary Command Injection Affecting surrealdb-core package, versions <2.0.5>=2.1.0 <2.1.5>=2.2.0 <2.2.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Command Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUST-SURREALDBCORE-10075110
- published9 May 2025
- disclosed11 Apr 2025
- creditcure53
Introduced: 11 Apr 2025
CVE NOT AVAILABLE CWE-77 (opens in a new tab)How to fix?
Upgrade surrealdb-core to version 2.0.5, 2.1.5, 2.2.2 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Command Injection via the export and import operations. An attacker can escalate privileges and gain root access to the SurrealDB instance by injecting malicious SurrealQL code into table or field names, which are then exported and reimported without proper sanitisation.
Note:
This is only exploitable if the attacker has authenticated access with OWNER or EDITOR roles and the ability to create or modify table or field names.
Workaround
This vulnerability can be mitigated by manually inspecting the exported data for injected statements, prior to importing.