surrealdb (crates.io)
Advisories
107
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.2.0 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p surrealdb --precise 3.2.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-gw59-x2xr-wwvr Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation Withdrawn |
Medium | all versions | No fix yet |
| GHSA-m464-hj36-96vx Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects Withdrawn |
High | all versions | No fix yet |
| GHSA-mf42-3c8q-x7x8 Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries Withdrawn |
Medium | all versions | No fix yet |
| GHSA-4f9v-jpx9-mjvw Duplicate Advisory: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level Withdrawn |
Medium | all versions | No fix yet |
| GHSA-p7hp-79jj-q923 Duplicate Advisory: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages Withdrawn |
Medium | all versions | No fix yet |
| GHSA-8pr5-wpg9-2h74 Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from` Withdrawn |
Medium | all versions | No fix yet |
| GHSA-vq7c-3hc9-m5hr Duplicate Advisory: SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect Withdrawn |
Medium | all versions | No fix yet |
| GHSA-4q5r-gwcx-24m9 Duplicate Advisory: SurrealDB: Graph traversal bypasses table SELECT permissions Withdrawn |
Medium | all versions | No fix yet |
| GHSA-9c3h-q3pp-fw5x Duplicate Advisory: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals Withdrawn |
Medium | >= 3.1.0 | No fix yet |
| GHSA-3f6w-45q9-v69m Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path Withdrawn |
High | all versions | No fix yet |
| GHSA-6g69-7xmf-h2x7 Duplicate Advisory: Writes in a PERMISSIONS clause bypass table permissions Withdrawn |
Medium | all versions | No fix yet |
| GHSA-j6mj-v752-pp4x Duplicate Advisory: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users Withdrawn |
Medium | <= 3.1.3 | No fix yet |
| GHSA-8rw6-p7m8-63jp SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users |
High EPSS 0.36% |
< 3.1.4 | 3.1.4 |
| GHSA-848m-r628-vrxw SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path |
High EPSS 0.37% |
< 3.2.0 | 3.2.0 |
| GHSA-xhwm-9486-8rgr Duplicate Advisory: SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF) Withdrawn |
High | all versions | No fix yet |
| GHSA-j9rh-f527-3x87 Duplicate Advisory: Improper Authorization in Select Permissions Withdrawn |
Medium | all versions | No fix yet |
| GHSA-f7q6-7rq9-3phx Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB Withdrawn |
High | all versions | No fix yet |
| GHSA-h5q3-3v5q-v5j8 Duplicate Advisory: SurrealDB server-takeover via SurrealQL injection on backup import Withdrawn |
High | all versions | No fix yet |
| GHSA-6g9r-xqrf-34xh Duplicate Advisory: SurrealDB no JavaScript script function default timeout could facilitate DoS Withdrawn |
Medium | all versions | No fix yet |
| GHSA-vp9r-94xg-q7q8 Duplicate Advisory: SurrealDB allows bypass of deny-net flags via DNS resolution Withdrawn |
High | >= 2.1.0, <= 2.1.7 | No fix yet |
| GHSA-9qrf-6whp-92w3 Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role Withdrawn |
Medium | all versions | No fix yet |
| GHSA-hgp5-pm7v-q8vg Duplicate Advisory: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User Withdrawn |
Medium | <= 1.5.3 | No fix yet |
| GHSA-9qjc-q7hw-vw5r Duplicate Advisory: Uncaught Exception in Macro Expecting Native Function to Exist Withdrawn |
Medium | <= 1.1.1 | No fix yet |
| GHSA-vmg6-53r4-jhpw Duplicate Advisory: SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type Withdrawn |
Medium | >= 2.0.0 | No fix yet |
| GHSA-m8pp-qc66-6pgp Duplicate Advisory: Full Table Permissions by Default Withdrawn |
High | all versions | No fix yet |
| GHSA-m3c3-78fh-w3w7 SurrealDB allows bypass of deny-net flags via DNS resolution |
High EPSS 0.45% |
>= 2.2.0, < 2.2.6 | 2.2.6 |
| GHSA-m3c3-78fh-w3w7 SurrealDB allows bypass of deny-net flags via DNS resolution |
High EPSS 0.45% |
>= 2.3.0, < 2.3.6 | 2.3.6 |
| GHSA-m3c3-78fh-w3w7 SurrealDB allows bypass of deny-net flags via DNS resolution |
High EPSS 0.45% |
>= 3.0.0-alpha.1, < 3.0.0-alpha.7 | 3.0.0-alpha.7 |
| GHSA-m3c3-78fh-w3w7 SurrealDB allows bypass of deny-net flags via DNS resolution |
High EPSS 0.45% |
>= 2.1.0, < 2.1.8 | 2.1.8 |
| GHSA-2f98-6626-h2p2 Duplicate Advisory: SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field Withdrawn |
Medium | >= 3.0.0 | No fix yet |
| GHSA-whwg-vh4f-pmmf SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted |
Medium EPSS 0.35% |
< 3.1.0 | 3.1.0 |
| GHSA-fwg2-gr34-q3w8 SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation |
Medium EPSS 0.28% |
< 3.1.0 | 3.1.0 |
| GHSA-c8jx-96c9-8xrp SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-wp87-mgvq-5j93 SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-97vg-427p-8hx5 SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect |
Medium EPSS 0.25% |
< 3.1.0 | 3.1.0 |
| GHSA-6wqw-vhfr-9999 SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-f82j-v89j-mf86 SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-fpxg-5xmv-922m SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from` |
Medium EPSS 0.29% |
< 3.1.0 | 3.1.0 |
| GHSA-6g9v-7gq3-p2c6 SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages |
Medium EPSS 0.33% |
< 3.1.0 | 3.1.0 |
| GHSA-4m82-p8cx-f94j SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-65rj-r9fh-jp2v SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-gcwr-5mrf-fvch SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries |
Medium EPSS 0.31% |
< 3.1.0 | 3.1.0 |
| GHSA-4v76-cw68-4vc9 SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-6vg3-hgrw-p5gf SurrealDB has an Authorization Bypass via Composite Record-id Paths |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-vjjx-rfw4-rmfc SurrealDB: Graph traversal bypasses table SELECT permissions |
High EPSS 0.40% |
< 3.1.0 | 3.1.0 |
| GHSA-98fx-66cf-fc7c SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level |
High EPSS 0.36% |
< 3.1.0 | 3.1.0 |
| GHSA-q8qp-67f9-wr3f SurrealDB vulnerable to Denial of Service due to nested types annotations |
Medium | < 3.1.0 | 3.1.0 |
| GHSA-wjjj-24cx-f28g SurrealDB has unauthenticated remote DoS via malformed RPC `use` call |
High | < 3.1.0 | 3.1.0 |
| GHSA-q729-696q-g9pq SurrealDB has Denial of Service in JSON parser due to nested objects |
High EPSS 0.52% |
< 3.1.0 | 3.1.0 |
| GHSA-4vgr-h27g-cf9p SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation |
High | < 3.1.0 | 3.1.0 |
| GHSA-5qfp-32cf-69jh SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers |
High | < 3.1.0 | 3.1.0 |
| GHSA-jv2j-mqmw-xvv5 SurrealDB: Denial of Service via deep operator chains |
Medium | >= 3.0.0, < 3.1.5 | 3.1.5 |
| GHSA-hv6h-hc26-q48p SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals |
Medium EPSS 0.28% |
>= 3.1.0, < 3.1.5 | 3.1.5 |
| GHSA-h4h3-3rfj-x6fq SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field |
Medium | >= 3.0.0, < 3.1.5 | 3.1.5 |
| GHSA-cc8f-fcx3-gpjr SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter |
High | < 3.1.5 | 3.1.5 |
| GHSA-h5rg-8p7f-47g2 SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch |
Medium | < 3.1.5 | 3.1.5 |
| GHSA-xx7m-69ff-9crp SurrealDB vulnerable to Denial of Service through scripting function memory edge case |
Medium EPSS 0.45% |
>= 3.0.0-alpha.8, < 3.0.0-beta.3 | 3.0.0-beta.3 |
| GHSA-xx7m-69ff-9crp SurrealDB vulnerable to Denial of Service through scripting function memory edge case |
Medium EPSS 0.45% |
< 2.6.1 | 2.6.1 |
| GHSA-3v2x-9xcv-2v2v SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions |
High EPSS 0.50% |
< 2.5.0 | 2.5.0 |
| GHSA-3v2x-9xcv-2v2v SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions |
High EPSS 0.50% |
>= 3.0.0-alpha.1, < 3.0.0-beta.3 | 3.0.0-beta.3 |
| GHSA-98f8-j56x-2hh4 Duplicate Advisory: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions Withdrawn |
Medium | >= 2.3.0 | No fix yet |
| GHSA-7vm2-j586-vcvc SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions |
Medium EPSS 0.33% |
>= 2.3.0, < 2.3.8 | 2.3.8 |
| GHSA-7vm2-j586-vcvc SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions |
Medium EPSS 0.33% |
>= 2.2.0, < 2.2.8 | 2.2.8 |
| GHSA-7vm2-j586-vcvc SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions |
Medium EPSS 0.33% |
>= 3.0.0-alpha.0, < 3.0.0-alpha.8 | 3.0.0-alpha.8 |
| GHSA-7vm2-j586-vcvc SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions |
Medium EPSS 0.33% |
< 2.1.9 | 2.1.9 |
| GHSA-5q9x-554g-9jgg SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF) |
High EPSS 0.33% |
< 2.0.5 | 2.0.5 |
| GHSA-5q9x-554g-9jgg SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF) |
High EPSS 0.33% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-5q9x-554g-9jgg SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF) |
High EPSS 0.33% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-pxw4-94j3-v9pf SurrealDB CPU exhaustion via custom functions result in total DoS |
Medium EPSS 0.55% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-pxw4-94j3-v9pf SurrealDB CPU exhaustion via custom functions result in total DoS |
Medium EPSS 0.55% |
< 2.0.5 | 2.0.5 |
| GHSA-pxw4-94j3-v9pf SurrealDB CPU exhaustion via custom functions result in total DoS |
Medium EPSS 0.55% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-3824-qmfq-2qv7 SurrealDB no JavaScript script function default timeout could facilitate DoS |
Medium EPSS 0.55% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-3824-qmfq-2qv7 SurrealDB no JavaScript script function default timeout could facilitate DoS |
Medium EPSS 0.55% |
< 2.0.5 | 2.0.5 |
| GHSA-3824-qmfq-2qv7 SurrealDB no JavaScript script function default timeout could facilitate DoS |
Medium EPSS 0.55% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-3633-g6mg-p6qq SurrealDB memory exhaustion via string::replace using regex |
Medium EPSS 0.45% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-3633-g6mg-p6qq SurrealDB memory exhaustion via string::replace using regex |
Medium EPSS 0.45% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-3633-g6mg-p6qq SurrealDB memory exhaustion via string::replace using regex |
Medium EPSS 0.45% |
< 2.0.5 | 2.0.5 |
| GHSA-ccj3-5p93-8p42 SurrealDB server-takeover via SurrealQL injection on backup import |
High EPSS 0.44% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-ccj3-5p93-8p42 SurrealDB server-takeover via SurrealQL injection on backup import |
High EPSS 0.44% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-ccj3-5p93-8p42 SurrealDB server-takeover via SurrealQL injection on backup import |
High EPSS 0.44% |
< 2.0.5 | 2.0.5 |
| GHSA-2cvj-g5r5-jrrg SurrealDB has local file read of 2-column TSV files via analyzers |
Medium EPSS 0.37% |
< 2.1.5 | 2.1.5 |
| GHSA-2cvj-g5r5-jrrg SurrealDB has local file read of 2-column TSV files via analyzers |
Medium EPSS 0.37% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-m7rc-8w7m-r9qr SurrealDB vulnerable to memory exhaustion via nested functions and scripts |
Medium EPSS 0.46% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-m7rc-8w7m-r9qr SurrealDB vulnerable to memory exhaustion via nested functions and scripts |
Medium EPSS 0.46% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-m7rc-8w7m-r9qr SurrealDB vulnerable to memory exhaustion via nested functions and scripts |
Medium EPSS 0.46% |
< 2.0.5 | 2.0.5 |
| GHSA-rq86-9m6r-cm3g SurrealDB has uncaught exception in Net module that leads to database crash |
Medium EPSS 0.56% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-rq86-9m6r-cm3g SurrealDB has uncaught exception in Net module that leads to database crash |
Medium EPSS 0.56% |
>= 2.2.0, < 2.2.2 | 2.2.2 |
| GHSA-rq86-9m6r-cm3g SurrealDB has uncaught exception in Net module that leads to database crash |
Medium EPSS 0.56% |
< 2.0.5 | 2.0.5 |
| GHSA-27vq-hv74-7cqp SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type |
Medium EPSS 0.27% |
>= 2.0.0, < 2.1.4 | 2.1.4 |
| GHSA-m52v-24p8-654f SurrealDB has an Uncaught Exception Sorting Tables by Random Order |
High EPSS 0.45% |
< 2.1.0 | 2.1.0 |
| GHSA-jc55-246c-r88f SurrealDB has an Uncaught Exception Handling Nonexistent Role |
Medium EPSS 0.47% |
< 2.1.0 | 2.1.0 |
| GHSA-h4f5-h82v-5w4r SurrealDB has an Uncaught Exception in Function Generating Random Time |
High EPSS 0.45% |
< 2.1.0 | 2.1.0 |
| GHSA-9722-9j67-vjcr SurrealDB: Improper Authorization in Select Permissions |
Medium EPSS 0.36% |
< 2.0.4 | 2.0.4 |
| GHSA-qjrv-v6qp-x99x SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings |
Medium EPSS 0.45% |
>= 2.0.0, < 2.0.4 | 2.0.4 |
| GHSA-64f8-pjgr-9wmr Untrusted Query Object Evaluation in RPC API |
High EPSS 0.64% |
all versions | No fix yet |
| GHSA-64f8-pjgr-9wmr Untrusted Query Object Evaluation in RPC API |
High EPSS 0.64% |
< 1.5.5 | 1.5.5 |
| GHSA-64f8-pjgr-9wmr Untrusted Query Object Evaluation in RPC API |
High EPSS 0.64% |
>= 2.0.0-beta.1, < 2.0.0-beta.3 | 2.0.0-beta.3 |
| GHSA-gh9f-6xm2-c4j2 SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User |
Medium EPSS 0.34% |
>= 2.0.0-alpha.1, < 2.0.0-alpha.6 | 2.0.0-alpha.6 |
| GHSA-gh9f-6xm2-c4j2 SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User |
Medium EPSS 0.34% |
< 1.5.4 | 1.5.4 |
| GHSA-q3gg-m8hr-h4x4 Externally Controlled Format String in Scripting Functions |
Critical EPSS 0.57% |
< 1.1.1 | 1.1.1 |
| GHSA-6wr5-jmpr-mjcx Uncaught Exception in Macro Expecting Native Function to Exist |
High EPSS 0.45% |
< 1.2.0 | 1.2.0 |
| GHSA-8xff-473h-f863 Uncaught Exception Handling Parsing Errors on Line Terminators |
High EPSS 0.45% |
< 1.2.1 | 1.2.1 |
| GHSA-58j9-j2fj-v8f4 SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface |
High | < 1.1.0 | 1.1.0 |
| GHSA-6r8p-hpg7-825g Uncontrolled Recursion in SurrealQL Parsing |
High EPSS 0.49% |
< 1.1.0 | 1.1.0 |
| GHSA-m24x-r6q3-2vp9 Uncaught Exception processing HTTP Headers in SurrealDB |
High EPSS 0.65% |
< 1.1.0 | 1.1.0 |
| GHSA-jm4v-58r5-66hj Uncaught Exception in surrealdb |
High EPSS 0.45% |
< 1.1.1 | 1.1.1 |
| GHSA-x5fr-7hhj-34j3 SurrealDB: Full Table Permissions by Default |
High EPSS 0.46% |
< 1.0.1 | 1.0.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor