CVEvulnerability

CVE-2024-58366

9.0 CRITICAL Published 2026-07-18 Modified 2026-10-27 Official page ↗
Status
Analyzed
Published
2026-07-18
Last modified
2026-10-27
Assigner
[email protected]
CVSS 4.0 ([email protected])
9.0 CRITICAL — CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
8.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-134

Description

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

Affected configurations

• delskayn rquickjs (< 0.4.2) • surrealdb surrealdb (< 1.1.1)

Related

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References