CVE-2025-71392
SurrealDB before 2.2.2 SurrealQL Injection via export
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.
| CWE | CWE-77 |
| Vendor | surrealdb |
| Product | surrealdb |
| Published | Jul 18, 2026 |
Get instant alerts for surrealdb surrealdb
Be the first to know when new unknown vulnerabilities affecting surrealdb surrealdb are published — delivered to Slack, Telegram or Discord.