Vulnerability · Published Jul 18, 2026 · Assigned by VulnCheck

CVE-2025-71392SurrealDB before 2.2.2 SurrealQL Injection via export

Critical 9.4

In plain English

A critical-severity command injection in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.4%top 61.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	2.2.0 – before 2.2.2
surrealdb	surrealdb	2.1.0 – before 2.1.5
surrealdb	surrealdb	0 – before 2.0.5

Weakness: CWE-77 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

GitHub Security Advisory (GHSA-ccj3-5p93-8p42) vendor-advisory
VulnCheck Advisory: SurrealDB before 2.2.2 SurrealQL Injection via export third-party-advisory