CVE-2024-58366: SurrealDB format string vulnerability in rquickjs scripting engine

CVE-2024-58366 · Severity: high · CVSS 8.5 · Published 2026-07-18

SurrealDB is a cloud-native database that supports advanced scripting functions. A vulnerability in its scripting engine allows users with script-execution privileges to trigger a memory error by providing specially crafted text. This could allow an attacker to read sensitive information from the server's memory or potentially take full control of the database process.

Technologies: surrealdb (crates.io). Vendors: crates.io, SurrealDB.

Quick answers

Is CVE-2024-58366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-58366 being exploited in the wild.
How severe is CVE-2024-58366?
High severity, with a CVSS score of 8.5, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) SEMVER:introduced=0,fixed=1.1.1; SurrealDB Rquickjs < 0.4.2.
Is there a fix for CVE-2024-58366?
Yes. surrealdb (crates.io): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58366 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-58366?
Check whether you run surrealdb (crates.io) or SurrealDB Rquickjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 1.1.1 or later
    cargo update -p surrealdb

Technical details

A format string vulnerability (CWE-134) exists in the rquickjs crate, which provides Rust bindings for the QuickJS engine used by SurrealDB. The Exception::throw_type function incorrectly passed user-controlled error strings directly to a printf-style function without proper sanitization. An attacker with permissions to define or execute scripting functions can provide inputs containing format specifiers (e.g., %s, %x) to trigger undefined behavior. This can be leveraged to leak process memory or achieve remote code execution (RCE), though RCE complexity is increased by Rust's default exploit mitigations and a 256-byte limit on error messages. The vulnerability is only exploitable if scripting is explicitly enabled via --allow-scripting or --allow-all.

Affected products

  • SurrealDB SurrealDB < 1.1.1
  • SurrealDB rquickjs < 0.4.2

Identifiers

  • CVE-2024-58366
  • GHSA-q3gg-m8hr-h4x4

Timeline

  • 2024-02-19: advisory: GitHub Security Advisory published
  • 2026-07-18: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.