VulnerabilityAnalyzed

CVE-2024-58366

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled.

CRITICAL 9.0EPSS 0.32%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

CVSS 4.0: 9.0 CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.32% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-134
Affected: delskayn/rquickjs · surrealdb/surrealdb
Source: disclosure@vulncheck.com

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4Vendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functionsThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.