Executive brief
SurrealDB is a modern database system used for storing and retrieving application data. A flaw in how it exports database backups allows lower-privileged users to hide malicious commands within table or field names. When an administrator imports such a backup, these hidden commands execute with full system privileges, giving attackers complete control over the database and all customer data it contains. This represents a critical risk for any organization using SurrealDB, particularly those with multiple user tiers.
Technical details
The vulnerability is a second-order SurrealQL injection attack in SurrealDB's command-line export/import functionality. The export command fails to properly escape special characters in table and field names, allowing authenticated System Users with OWNER or EDITOR roles to create tables or fields containing malicious SurrealQL syntax. When a higher-privileged user subsequently imports the exported backup file, the unescaped injection payload is parsed and executed with the importing user's privileges, resulting in privilege escalation. The attack requires initial authentication and user interaction (manual import), but applications allowing end-users to define custom tables or fields face universal second-order injection even when application-level query parameters are properly sanitized. Patched versions 2.0.5, 2.1.5, and 2.2.2 address the issue through proper escaping in the exporter.
Affected products
- SurrealDB SurrealDB < 2.0.5, 2.1.x < 2.1.5, 2.2.x < 2.2.2
Timeline
- 2025-04-10: disclosed: Original advisory GHSA-ccj3-5p93-8p42 published
- 2025-04-10: patched: Patches released: versions 2.0.5, 2.1.5, 2.2.2
- 2026-07-18: advisory: GHSA-h5q3-3v5q-v5j8 published as duplicate (later withdrawn)