{"id":"EUVD-2025-210483","enisaUuid":"2e12c0b1-fe0c-3eb7-9a99-58aa681859bf","description":"SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.","datePublished":"Jul 18, 2026, 1:10:11 PM","dateUpdated":"Oct 8, 2026, 3:21:28 PM","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42\nhttps://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export\n","aliases":"CVE-2025-71392\nGHSA-h5q3-3v5q-v5j8\n","assigner":"VulnCheck","epss":0.44,"enisaIdProduct":[{"id":"627aa7d7-10ad-3742-8704-1fa185028eec","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.0.5"},{"id":"d3aa8ace-dfd5-39c7-839f-e32eaca67c4f","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.2.2"},{"id":"db46f9bd-9832-3504-bf61-13fe2f6e7a84","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.1.5"}],"enisaIdVendor":[{"id":"3685d508-3c72-332c-9dea-ab862fb3b6d9","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"c176e8f5-1ae6-3c31-aaee-f4128465e53b","vulnerability":{"id":"CVE-2025-71392","description":"SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.","datePublished":"Jul 18, 2026, 1:10:11 PM","dateUpdated":"Oct 8, 2026, 3:21:28 PM","status":"PUBLISHED","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42\nhttps://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export\n","enisa_id":"EUVD-2025-210483\n","assigner":"VulnCheck","epss":0.44,"dataProcessed":"Oct 27, 2026, 7:19:40 AM","vulnerabilityProduct":[{"id":"0155b878-0874-3cfd-85a1-f33e598e303a","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.2.2"},{"id":"380b2f16-ec00-30ff-9903-53c84c322461","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.0.5"},{"id":"d8a26bfa-4e97-3a6c-9449-e99234040fa5","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.1.5"}],"vulnerabilityVendor":[{"id":"b4c29bd2-c683-3729-9982-7281ed971e97","vendor":{"name":"surrealdb"}}]}},{"id":"c251319b-5ba9-3f36-83d3-9a2da4130215","vulnerability":{"id":"GHSA-h5q3-3v5q-v5j8","description":"Duplicate Advisory: SurrealDB server-takeover via SurrealQL injection on backup import","datePublished":"Jul 18, 2026, 3:31:49 PM","dateUpdated":"Sep 4, 2026, 7:36:07 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71392\nhttps://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export\n","enisa_id":"EUVD-2025-210483\n","aliases":"GHSA-h5q3-3v5q-v5j8\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}