CVE-2025-71392

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.0.5 SurrealDB versions 2.1.x prior to 2.1.5 SurrealDB versions 2.2.x prior to 2.2.2

Description The command-line export command fails to properly escape table and field names. An authenticated System User with OWNER or EDITOR roles can create tables or fields with names containing malicious SurrealQL. When a higher-privileged user imports the exported backup, the injected SurrealQL executes, leading to privilege escalation and root-level takeover of the instance. This also exposes applications that allow users to define custom tables or fields to a universal second-order SurrealQL injection, even if query parameters are sanitized.

Recommendations Update to version 2.0.5 Update to version 2.1.5 Update to version 2.2.2