surrealdb-core (crates.io)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 3.2.0 or later clears every advisory below that has a fix.

Upgrade commands

cargo

cargo update -p surrealdb-core --precise 3.2.0

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-66r2-5gwj-gxm2 SurrealDB: Writes in a PERMISSIONS clause bypass table permissions	Medium EPSS 0.29%	`< 3.2.0`	`3.2.0`
GHSA-27vq-hv74-7cqp SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type	Medium EPSS 0.27%	`>= 2.0.0, < 2.1.4`	`2.1.4`
GHSA-m52v-24p8-654f SurrealDB has an Uncaught Exception Sorting Tables by Random Order	High EPSS 0.45%	`< 2.1.0`	`2.1.0`
GHSA-jc55-246c-r88f SurrealDB has an Uncaught Exception Handling Nonexistent Role	Medium EPSS 0.47%	`< 2.1.0`	`2.1.0`
GHSA-h4f5-h82v-5w4r SurrealDB has an Uncaught Exception in Function Generating Random Time	High EPSS 0.45%	`< 2.1.0`	`2.1.0`
GHSA-9722-9j67-vjcr SurrealDB: Improper Authorization in Select Permissions	Medium EPSS 0.36%	`< 2.0.4`	`2.0.4`
GHSA-qjrv-v6qp-x99x SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings	Medium EPSS 0.45%	`>= 2.0.0, < 2.0.4`	`2.0.4`
GHSA-64f8-pjgr-9wmr Untrusted Query Object Evaluation in RPC API	High EPSS 0.64%	`< 1.5.2`	`1.5.2`
GHSA-gh9f-6xm2-c4j2 SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User	Medium EPSS 0.34%	`< 1.5.1`	`1.5.1`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor