CVE-2024-58366
Received Received - Intake

Format String Vulnerability in SurrealDB Enables Arbitrary Memory Read

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulnCheck

Description
SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2024-58366
EUVD
EUVD-2024-55682

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
surrealdb surrealdb to 1.1.1 (exc)
rquickjs rquickjs to 0.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-134 The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a format string vulnerability in SurrealDB versions before 1.1.1. It occurs in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs, allowing them to read arbitrary memory or execute code with SurrealDB process privileges.

Detection Guidance

Check SurrealDB version with command: surrealdb version. If version is below 1.1.1, the system is vulnerable. Verify if scripting is enabled by inspecting startup flags or environment variables like --scripting or SURREALDB_SCRIPTING=true.

Impact Analysis

If exploited, this vulnerability could allow attackers to read sensitive memory or execute arbitrary code on the SurrealDB server. This could lead to unauthorized data access, system compromise, or disruption of database services. The impact depends on whether scripting is enabled in your SurrealDB instance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Organizations using affected SurrealDB versions may face regulatory penalties or data breach notifications if exploited.

Mitigation Strategies

Update SurrealDB to version 1.1.1 or later. If updating is not possible, disable scripting by removing scripting-related flags or environment variables. Restrict access to scripting functions and ensure only trusted users have scripting privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart