{"id":"EUVD-2024-55682","enisaUuid":"0847571f-f701-3481-ada7-3b0dbc3a8d0b","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","datePublished":"Jul 18, 2026, 1:10:06 PM","dateUpdated":"Jul 28, 2026, 1:47:52 AM","baseScore":9.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4\nhttps://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions\n","aliases":"CVE-2024-58366\nGHSA-qcfm-cmfw-f4x4\n","assigner":"VulnCheck","epss":0.58,"enisaIdProduct":[{"id":"91e1f59c-dd30-38f5-ac96-0e764c1d6941","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c0.4.2"},{"id":"bad6fee2-d287-3680-bf77-dd69ed7c1eca","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.1.1"}],"enisaIdVendor":[{"id":"af99aa5d-7c96-3c84-a212-94d672b27373","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"20dedc13-21cb-3bd6-8c61-c89360972a65","vulnerability":{"id":"GHSA-qcfm-cmfw-f4x4","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","datePublished":"Jul 18, 2026, 3:31:49 PM","dateUpdated":"Jul 18, 2026, 3:31:49 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58366\nhttps://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions\n","enisa_id":"EUVD-2024-55682\n","aliases":"CVE-2024-58366\nGHSA-qcfm-cmfw-f4x4\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"3c129704-61c2-38e5-b166-ab832031cc71","vulnerability":{"id":"CVE-2024-58366","description":"SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.","datePublished":"Jul 18, 2026, 1:10:06 PM","dateUpdated":"Jul 28, 2026, 1:47:52 AM","status":"PUBLISHED","baseScore":9.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4\nhttps://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions\n","enisa_id":"EUVD-2024-55682\n","assigner":"VulnCheck","epss":0.58,"dataProcessed":"Oct 27, 2026, 7:19:40 AM","vulnerabilityProduct":[{"id":"b10a57e4-fce0-3c05-b83b-df69d87779bb","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.1.1"},{"id":"ba6ec21a-7b77-346e-b5d9-9c83a17c7c01","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c0.4.2"}],"vulnerabilityVendor":[{"id":"1e9f95a2-fc67-3f1a-b18a-d4d0d5a4a8e7","vendor":{"name":"surrealdb"}}]}}],"enisaIdAdvisory":[]}