CVE-2024-58366: SurrealDB Format String RCE Vulnerability

CVE-2024-58366 Overview

CVE-2024-58366 is a format string vulnerability affecting SurrealDB versions prior to 1.1.1. The flaw resides in the rquickjsException::throw_type function, which is reachable when scripting is enabled inside the database. Attackers who hold scripting privileges can inject format string sequences into error inputs. This lets them read arbitrary process memory or execute code under the SurrealDB process context. The issue is tracked under [CWE-134] (Use of Externally-Controlled Format String) and carries a CVSS 4.0 base score of 9.0.

Critical Impact
Authenticated attackers with scripting access can read arbitrary memory or execute code with SurrealDB process privileges, leading to full database compromise.

Affected Products

SurrealDB versions prior to 1.1.1
Deployments with scripting functions enabled
Any instance permitting untrusted users to execute scripting queries

Discovery Timeline

2026-07-18 - CVE-2024-58366 published to the National Vulnerability Database (NVD)
2026-07-21 - CVE-2024-58366 last modified in NVD

Technical Details for CVE-2024-58366

Vulnerability Analysis

SurrealDB embeds the rquickjs binding layer over the QuickJS JavaScript engine to support user-defined scripting functions. When a scripted operation throws a type error, SurrealDB passes attacker-controlled error content into Exception::throw_type. That function forwards the string to a C-style formatting routine without stripping or escaping conversion specifiers. As a result, tokens such as %s, %x, and %n are interpreted as format directives instead of literal characters. Attackers with the SCRIPTING privilege can craft error inputs that dereference stack or heap memory, disclose sensitive process state, or write to memory addresses through the %n specifier. Successful write-primitives can be chained into arbitrary code execution inside the SurrealDB server process.

Root Cause

The root cause is unsanitized user input flowing into a format string parameter. The Exception::throw_type binding in rquickjs treats the caller-supplied message as a format template rather than a fixed literal, so any conversion specifier in the message is honored during formatting.

Attack Vector

Exploitation requires network reachability to the SurrealDB endpoint, scripting privileges, and the ability to issue a scripting query. The attacker submits a script that triggers a type exception with a message containing format specifiers. See the GitHub Security Advisory GHSA-q3gg-m8hr-h4x4 and the VulnCheck Advisory for technical detail.

No verified public exploit code is available. Refer to the vendor advisory for reproduction details.

Detection Methods for CVE-2024-58366

Indicators of Compromise

Scripting queries containing format specifiers such as %s, %x, %p, or %n inside error message constructors
SurrealDB process crashes or segmentation faults following user scripting activity
Unexpected outbound connections initiated by the SurrealDB service account
New or modified scripting functions submitted by non-administrative principals

Detection Strategies

Inspect SurrealDB query logs for scripted throw or TypeError invocations that embed printf-style tokens
Alert on scripting activity from accounts that historically issue only data queries
Correlate SurrealDB error volume spikes with authenticated scripting sessions

Monitoring Recommendations

Enable verbose query and audit logging on all SurrealDB nodes and forward events to a central SIEM
Track process integrity of the SurrealDB binary and its child processes
Monitor for privilege changes granting SCRIPTING capability to service or application accounts

How to Mitigate CVE-2024-58366

Immediate Actions Required

Upgrade SurrealDB to version 1.1.1 or later on every node
Disable scripting functions on instances that do not require them by starting the server without the --allow-scripting flag
Revoke scripting privileges from accounts that do not need them and audit remaining grantees
Restrict network exposure of SurrealDB endpoints to trusted application tiers only

Patch Information

The vulnerability is fixed in SurrealDB 1.1.1. The patch removes the format string interpretation path in the rquickjsException::throw_type binding so caller-supplied messages are treated as literal strings. Details are published in the GitHub Security Advisory GHSA-q3gg-m8hr-h4x4.

Workarounds

Start SurrealDB with scripting disabled until upgrade completion
Enforce network access control lists so only vetted application services can reach the database
Rotate any credentials or secrets accessible to the SurrealDB process after confirming no exploitation occurred

bash

# Start SurrealDB without scripting enabled
surreal start --user root --pass <password> --bind 127.0.0.1:8000 file:/var/lib/surrealdb
# Omit --allow-scripting to disable the vulnerable code path