CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 1.1.1 are vulnerable due to a format string vulnerability in the rquickjs Exception::throw_type function, which can be exploited by attackers with scripting privileges. This flaw allows for the reading of arbitrary memory or the execution of code with the same privileges as the SurrealDB process. Organizations using SurrealDB with scripting enabled should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.
Related CVEs
Other vulnerabilities affecting the same vendor(s)