{"id":"EUVD-2025-210483","enisaUuid":"2e12c0b1-fe0c-3eb7-9a99-58aa681859bf","description":"SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.","datePublished":"Jul 18, 2026, 1:10:11 PM","dateUpdated":"Oct 29, 2026, 9:15:20 PM","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42\nhttps://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export\n","aliases":"CVE-2025-71392\nGHSA-h5q3-3v5q-v5j8\n","assigner":"VulnCheck","epss":0.44,"enisaIdProduct":[{"id":"1181511a-3f4e-3a0c-a6bf-5e1b2fa71903","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.2.0 \u003c2.2.2"},{"id":"627aa7d7-10ad-3742-8704-1fa185028eec","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.0.5"},{"id":"b01ca2fd-601b-317d-844c-03393a65cfb2","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.1.0 \u003c2.1.5"}],"enisaIdVendor":[{"id":"3685d508-3c72-332c-9dea-ab862fb3b6d9","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"c176e8f5-1ae6-3c31-aaee-f4128465e53b","vulnerability":{"id":"CVE-2025-71392","description":"SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.","datePublished":"Jul 18, 2026, 1:10:11 PM","dateUpdated":"Oct 29, 2026, 9:15:20 PM","status":"PUBLISHED","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42\nhttps://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export\n","enisa_id":"EUVD-2025-210483\n","assigner":"VulnCheck","epss":0.44,"dataProcessed":"Oct 30, 2026, 3:00:42 AM","vulnerabilityProduct":[{"id":"2766185f-d79d-30b8-95e8-404dafd4a8d4","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.2.0 \u003c2.2.2"},{"id":"2b14d745-70b1-3f22-aba2-2683ee5f91fc","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.1.0 \u003c2.1.5"},{"id":"380b2f16-ec00-30ff-9903-53c84c322461","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.0.5"}],"vulnerabilityVendor":[{"id":"b4c29bd2-c683-3729-9982-7281ed971e97","vendor":{"name":"surrealdb"}}]}},{"id":"c251319b-5ba9-3f36-83d3-9a2da4130215","vulnerability":{"id":"GHSA-h5q3-3v5q-v5j8","description":"Duplicate Advisory: SurrealDB server-takeover via SurrealQL injection on backup import","datePublished":"Jul 18, 2026, 3:31:49 PM","dateUpdated":"Sep 4, 2026, 7:36:07 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71392\nhttps://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export\n","enisa_id":"EUVD-2025-210483\n","aliases":"GHSA-h5q3-3v5q-v5j8\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}