SurrealDB before 1.5.5 Query Injection via RPC API

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2024-58362 · Microsoft / collected KEV context

EUVD-2024-55678

GHSA-xw2c-hrr9-4xwr

GHSA-64f8-pjgr-9wmr

cve-program · CVE-2024-58362

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr
• https://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api

euvd · EUVD-2024-55678

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr
• https://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api

nvd · CVE-2024-58362

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr
• https://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api

osv · GHSA-64f8-pjgr-9wmr

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr
• https://github.com/surrealdb/surrealdb/commit/b7583a653a2c495a60630dffd663f506426db330
• https://github.com/surrealdb/surrealdb/commit/eab7ef5354168d4039f7f7b77042c99a52f770a6
• https://github.com/surrealdb/surrealdb
• https://surrealdb.com/docs/surrealdb/integration/rpc#signin
• https://surrealdb.com/docs/surrealdb/integration/rpc#signup
• https://surrealdb.com/docs/surrealdb/security/authentication#record-users

osv · GHSA-xw2c-hrr9-4xwr

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr
• https://nvd.nist.gov/vuln/detail/CVE-2024-58362
• https://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api

No related operational record is retained in the current change model.